Granted Patent B2

US 12,563,083 · App. 18/488,764 · Granted Feb 24, 2026

Inventors: Dylan Martin (Belfast, GB); Austin Lee (Pasadena, CA); Trever Allen McKee (Shafter, CA); James Andrew Green (Hidden Hills, CA); Chris DeRamus (Ashburn, VA)

Assignee: Rapid7, Inc.

H04L63/1433G06F21/554H04L47/82G06F2221/034

Abstract

Claims (68)

1 . A method for event-driven monitoring of resources in a cloud computing environment, the method comprising:

using at least one computer hardware processor to perform:

obtaining, from the cloud computing environment, information about at least one cloud computing event;

determining, using the information obtained from the cloud computing environment, whether the at least one cloud computing event is associated with allocation of storage for a virtual cloud computing resource;

in response to determining that the at least one cloud computing event is associated with the allocation of the storage for the virtual cloud computing resource, requesting data from the storage allocated to the virtual cloud computing resource; and

analyzing the data to detect presence of one or more security risks.

2 . The method of claim 1 ,

wherein the at least one cloud computing event comprises a first cloud computing event, and

wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises obtaining information about features including a time at which the first cloud computing event occurred, an event type for the first cloud computing event, one or more unique event identifiers for the first cloud computing event, storage associated with the first cloud computing event, and a virtual cloud computing resource associated with the first cloud computing event.

3 . The method of claim 1 ,

wherein requesting the data from the storage allocated to the virtual cloud computing resource is performed in response to determining that a first cloud computing event is associated with allocation of storage for a virtual cloud computing service, and

wherein the first cloud computing event is associating the storage with the virtual cloud computing resource.

4 . The method of claim 3 ,

wherein the cloud computing environment is an Amazon Web Services cloud computing environment, and

wherein the first cloud computing event is an Attach Volume event.

5 . The method of claim 1 ,

wherein requesting the data from the storage allocated to the virtual cloud computing resource is performed in response to determining that two cloud computing events are associated with allocation of storage for a virtual cloud computing service,

wherein the two cloud computing events are:

allocating storage in the cloud computing environment, and

associating the allocated storage with the virtual cloud computing resource.

6 . The method of claim 5 ,

wherein the cloud computing environment is an Amazon Web Services cloud computing environment,

wherein the two cloud computing events are a Create Volume event and an Attach Volume event.

7 . The method of claim 1 , wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises:

accessing a log of cloud computing events within the cloud computing environment; and

obtaining information about the at least one cloud computing event from the log.

8 . The method of claim 1 , wherein requesting the data from the storage allocated to the virtual cloud computing resource comprises taking a snapshot of the storage allocated to the virtual cloud computing resource.

9 . The method of claim 1 , further comprising:

when it is detected that the one or more security risks are present within the data, recommending one or more respective corrective actions to address the one or more security risks, wherein the respective corrective actions comprise at least one of: updating software installed in the virtual cloud computing resource, changing a network configuration of the virtual cloud computing resource, changing a configuration of one or more software applications executing on the virtual cloud computing resource, changing a configuration of an operating system executing on the virtual cloud computing resource, changing one or more permissions for the virtual cloud computing resource, deleting malware from the virtual cloud computing resource, removing corrupted files or data from the virtual cloud computing resource, taking the virtual cloud computing resource offline, killing an instance of the virtual cloud computing resource, and/or blocking communications to and/or from the virtual cloud computing resource.

10 . The method of claim 1 , wherein analyzing the data to detect presence of one or more security risks comprises identifying the presence of one or more software bugs, one or more out-of-date software applications, one or more unpatched software applications, corrupted data, unencrypted data, one or more improper access permissions for resources, one or more misconfigurations, one or more computer viruses, and/or malware within the data.

11 . The method of claim 1 , wherein the at least one cloud computing event comprises a first event, wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises:

obtaining, from the cloud computing environment, first data related to the first event that occurred in the cloud computing environment, the first event relating to a first resource in the cloud computing environment, the first data including a first identifier for the first event; and

in response to obtaining the first data, requesting, from an application programming interface (API) of the cloud computing environment and using the first identifier, supplemental data about the first event, the supplemental data including supplemental information about the first event and/or information about impact of the first event on the first resource.

12 . The method of claim 11 , wherein information about the impact of the first event on the first resource comprises information about changes to an amount of storage associated with the first resource and information about changes to metadata associated with the first resource, and wherein information about changes to metadata associated with the first resource comprises information about changes to a structure of data within the first resource, changes to software installed on the first resource, changes to permissions for accessing the first resource, and/or changes to security rules relating to the first resource.

13 . A system for event-driven monitoring of resources in a cloud computing environment, the system comprising:

at least one computer hardware processor; and

at least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by the at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising:

obtaining, from the cloud computing environment, information about at least one cloud computing event;

determining, using the information obtained from the cloud computing environment, whether the at least one cloud computing event is associated with allocation of storage for a virtual cloud computing resource;

in response to determining that the at least one cloud computing event is associated with the allocation of the storage for the virtual cloud computing resource, requesting data from the storage allocated to the virtual cloud computing resource; and

analyzing the data to detect presence of one or more security risks.

14 . The system of claim 13 ,

wherein the at least one cloud computing event comprises a first cloud computing event, and

wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises obtaining information about features including a time at which the first cloud computing event occurred, an event type for the first cloud computing event, one or more unique event identifiers for the first cloud computing event, storage associated with the first cloud computing event, and a virtual cloud computing resource associated with the first cloud computing event.

15 . The system of claim 13 ,

wherein requesting the data from the storage allocated to the virtual cloud computing resource is performed in response to determining that a first cloud computing event is associated with allocation of storage for a virtual cloud computing service, and

wherein the first cloud computing event is associating the storage with the virtual cloud computing resource.

16 . The system of claim 13 ,

wherein requesting the data from the storage allocated to the virtual cloud computing resource is performed in response to determining that two cloud computing events are associated with allocation of storage for a virtual cloud computing service,

wherein the two cloud computing events are:

allocating storage in the cloud computing environment, and

associating the allocated storage with the virtual cloud computing resource.

17 . At least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising:

obtaining, from a cloud computing environment, information about at least one cloud computing event;

determining, using the information obtained from the cloud computing environment, whether the at least one cloud computing event is associated with allocation of storage for a virtual cloud computing resource;

in response to determining that the at least one cloud computing event is associated with the allocation of the storage for the virtual cloud computing resource, requesting data from the storage allocated to the virtual cloud computing resource; and

analyzing the data to detect presence of one or more security risks.

18 . The at least one non-transitory computer-readable storage medium of claim 17 ,

wherein the at least one cloud computing event comprises a first cloud computing event, and

wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises obtaining information about features including a time at which the first cloud computing event occurred, an event type for the first cloud computing event, one or more unique event identifiers for the first cloud computing event, storage associated with the first cloud computing event, and a virtual cloud computing resource associated with the first cloud computing event.

19 . The at least one non-transitory computer-readable storage medium of claim 17 ,

wherein requesting the data from the storage allocated to the virtual cloud computing resource is performed in response to determining that a first cloud computing event is associated with allocation of storage for a virtual cloud computing service, and

wherein the first cloud computing event is associating the storage with the virtual cloud computing resource.

20 . The at least one non-transitory computer-readable storage medium of claim 17 ,

wherein requesting the data from the storage allocated to the virtual cloud computing resource is performed in response to determining that two cloud computing events are associated with allocation of storage for a virtual cloud computing service,

wherein the two cloud computing events are:

allocating storage in the cloud computing environment, and

associating the allocated storage with the virtual cloud computing resource.

Assignments (4)

Continuity (3)

References Cited (23)