Incremental cloud infrastructure detection for data security posture management

1. A system for analysis of infrastructure posture of a cloud environment, the system comprising:

a processor and memory accessible by the processor, the memory including instructions executable to:

detect a triggering criterion corresponding to initiation of an update scan of the infrastructure posture of the cloud environment

select a time period based on a previous scan of the infrastructure posture of the cloud environment;

invoke an incremental change detector based on the triggering criterion, the incremental change detector configured to scan the cloud environment and return a scan result that identifies one or more changes to a set of infrastructure assets in the cloud environment within the time period, and the one or more changes comprise at least one of:

adding a particular service or configuration in the cloud environment,

deleting a particular service or configuration in the cloud environment, or

editing a particular service or configuration in the cloud environment; and

update a cloud infrastructure graph based on the one or more changes to the set of infrastructure assets, wherein the cloud infrastructure graph defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources.

2. The system of claim 1 , wherein the triggering criterion is based on a duration of a previous scan of the infrastructure posture of the cloud environment.

3. The system of claim 1 , wherein each change, of the one or more changes to the set of infrastructure assets, comprises at least one of:

adding an infrastructure asset to the set of infrastructure assets,

deleting an infrastructure asset from the set of infrastructure assets, and

changing an infrastructure asset in the set of infrastructure assets.

4. The system of claim 1 , wherein the infrastructure assets comprise at least one of:

a compute resource,

a storage resource,

a privilege, or

a role.

5. The system of claim 1 , wherein the incremental change detector comprises a log analyzer microservice configured to scan an event log having a plurality of event log entries that represent events in the cloud environment.

6. The system of claim 5 , wherein the instructions are executable to:

provide a set of parameters to the log analyzer microservice, and

receive an analysis result from the log analyzer microservice based on the set of parameters, wherein the analysis result is indicative of a filtered set of event log entries from the plurality of event log entries.

7. The system of claim 5 , wherein the log analyzer microservice is configured to identify write changes in the event log.

8. The system of claim 1 , wherein the instructions are executable to update the cloud infrastructure graph by at least one of adding a node to the cloud infrastructure graph or deleting a node from the cloud infrastructure graph.

9. The system of claim 8 , wherein the scan result includes, for each particular change in the one or more changes, a first set of information on the particular change, and the instructions are executable to:

run a data scan on the cloud environment that is constrained to infrastructure assets having an identified change in the one or more changes;

obtain, from the data scan, a second set of information on each particular change in the one or more changes; and

update the cloud infrastructure graph using the first set of information and the second set of information for each change.

10. The system of claim 9 , wherein the instructions are executable to:

run the data scan by executing an add/delete/update query only for entities that had a change identified in the one or more changes.

11. The system of claim 1 , wherein the instructions are executable to:

filter a set of risk signatures based on the one or more changes to obtain a filtered set of risk signatures; and

apply the filtered set of risk signatures to the updated infrastructure graph to qualify one or more resources as vulnerable to breach attack.

12. The system of claim 11 , wherein the instructions are executable to:

filter the set of risk signatures based on comparing the one or more changes to tags assigned to the set of risk signatures, wherein the filtered set of risk signatures comprises some, but not all, of the set of risk signatures.

13. A computer-implemented method for analysis of infrastructure posture of a cloud environment, the computer-implemented method comprising:

detecting a triggering criterion corresponding to initiation of an update scan of the infrastructure posture of the cloud environment;

invoking an incremental change detector based on the triggering criterion, wherein invoking comprises:

selecting a time period based on a previous scan of the infrastructure posture of the cloud environment;

generating a scan parameter based on the time period;

scanning an event log, having a plurality of event log entries that represent events in the cloud environment, based on the scan parameter;

obtaining an analysis result indicative of a filtered set of event log entries from the plurality of event log entries; and

returning a scan result that identifies one or more changes to a set of infrastructure assets in the cloud environment based on the analysis result; and

updating a cloud infrastructure graph based on the one or more changes to the set of infrastructure assets, wherein the cloud infrastructure graph defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources.

14. The computer-implemented method of claim 13 , wherein each change, of the one or more changes to the set of infrastructure assets, comprises at least one of:

an infrastructure asset added to the set of infrastructure assets,

an infrastructure asset deleted from the set of infrastructure assets, and

an infrastructure asset changed in the set of infrastructure assets.

15. The computer-implemented method of claim 13 , and further comprising at least one of:

running a query on the cloud environment that is constrained based on the one or more changes; or

filtering a set of risk signatures based on the one or more changes to obtain a filtered set of risk signatures and applying the filtered set of risk signatures to the infrastructure posture of the cloud environment.

16. A computing system comprising:

an update trigger detector configured to detect a temporal criterion corresponding to initiation of an update scan of infrastructure posture of a cloud environment having a set of infrastructure assets;

a cloud infrastructure detector configured to:

access a cloud event log representing events with the cloud environment; and

scan the cloud event log to identify one or more incremental changes to a set of cloud infrastructure assets within a time period identified based on the temporal criterion;

a cloud infrastructure representation updater configured to update a representation of the infrastructure posture of the cloud environment based on the one or more incremental changes; and

an action generator configured to perform one or more post processing actions relative to the set of cloud infrastructure assets based on the one or more incremental changes, wherein the one or more post processing actions comprise filtering a set of risk signatures based on the one or more incremental changes to obtain a filtered set of risk signatures, applying the filtered set of risk signatures to the infrastructure posture of the cloud environment, and generating a result that indicates one or more infrastructure assets in the set of infrastructure assets as conforming to at least one risk signature in the filtered set of risk signatures.

17. The computing system of claim 16 , wherein the one or more post processing actions comprise at least one of:

updating a portion of a cloud infrastructure graph based on the one or more incremental changes; or

running a query on the cloud environment that is constrained based on the one or more incremental changes.

18. The computing system of claim 16 , wherein each incremental change, of the one or more incremental changes, comprises at least one of:

adding an infrastructure asset to the set of infrastructure assets,

deleting an infrastructure asset from the set of infrastructure assets, and

changing an infrastructure asset in the set of infrastructure assets.