Risk event detection using activity and graph-based context for cloud data security posture management
The technology disclosed relates to a system and method for detecting risk events in cloud environment that obtains set of risk signature definitions and deploys an event log scanner to the cloud environment. The event log scanner is configured to detect instances of candidate risk events in accordance with the set of risk signature definitions based on a scan of event log and to label each detected instance with a signature identifier that identifies one or more risk signatures that corresponds to the detected instance. Result metadata is received indicative of the detected instances, based on the result metadata, context information associated with the detected instances is obtained based on cloud infrastructure graph. An output is generated representing a classification of one or more of the detected instances of candidate risk events as a risk event based on the context information relative to the set of risk signature definitions.
1. A computing system comprising:
at least one processor;
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, provide:
risk signature logic configured to obtain a set of risk signature definitions, each risk signature definition, in the set of risk signature definitions, representing a corresponding risk signature;
matching logic configured to:
identify a plurality of input criteria for a risk signature;
scan an event log in a cloud environment;
determine a number of matches between the plurality of input criteria and a scanned event from the event log;
detect an instance of a candidate risk event based on a determination that the number of matches exceeds a threshold; and
generate result metadata indicative of the instance of the candidate risk event, the result metadata including a signature identifier that identifies the risk signature; and
post processing logic configured to:
identify a post processing action based on the signature identifier;
execute the post processing action to obtain context information associated with the instance of the candidate risk event based on a cloud infrastructure graph that defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources; and
generate an output representing a classification of the instance of the candidate risk event as a risk event based on the context information.
2. The computing system of claim 1 , wherein the instructions, when executed, provide:
deployment logic configured to deploy a container image that includes a representation of the risk signature in the cloud environment, the container image comprising an event log scanner configured to identify a plurality of events in the event log, the plurality of events comprising one or more of:
data creation events,
data movement events,
data deletion events, or
data update events.
3. The computing system of claim 2 , wherein the event log scanner is configured to perform event log scanning independent of event types.
4. The computing system of claim 1 , wherein the matching logic is configured to filter events in the event log with a set of properties.
5. The computing system of claim 4 , wherein the set of properties include one or more of:
resource information identifying a resource in which the event was performed,
identity information identifying an identity which performed the event, or
timestamp information identifying a time the event was performed.
6. The computing system of claim 1 , wherein the context information comprises an indication that a resource, associated with the scanned event, contains sensitive information.
7. The computing system of claim 6 , wherein the post processing logic is configured to set a risk level associated with the risk event based on the indication that the resource contains sensitive information.
8. A computer-implemented method for detecting risk events in a cloud environment, the computer-implemented method comprising:
obtaining a set of risk signature definitions, each risk signature definition, in the set of risk signature definitions, representing a corresponding risk signature;
identifying a plurality of input criteria for a risk signature;
scanning an event log in a cloud environment;
determining a number of matches between the plurality of input criteria and a scanned event from the event log;
detecting an instance of a candidate risk event based on a determination that the number of matches exceeds a threshold;
generating result metadata indicative of the instance of the candidate risk event, the result metadata including a signature identifier that identifies the risk signature;
identifying a post processing action based on the signature identifier;
executing the post processing action to obtain context information associated with the instance of the candidate risk event based on a cloud infrastructure graph that defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources; and
generating an output representing a classification of the instance of the candidate risk event as a risk event based on the context information.
9. The computer-implemented method of claim 8 , and further comprising:
deploying a container image that includes a representation of the risk signature in the cloud environment, the container image comprising an event log scanner configured to identify a plurality of events in the event log, the plurality of events comprising one or more of:
data creation events,
data movement events,
data deletion events, or
data update events.
10. The computer-implemented method of claim 9 , wherein the event log scanner is configured to perform event log scanning independent of event types.
11. The computer-implemented method of claim 8 , and further comprising:
filtering events in the event log with a set of properties.
12. The computer-implemented method of claim 11 , wherein the set of properties include one or more of:
resource information identifying a resource in which the event was performed,
identity information identifying an identity which performed the event, or
timestamp information identifying a time the event was performed.
13. The computer-implemented method of claim 8 , wherein the context information comprises an indication that a resource, associated with the scanned event, contains sensitive information.
14. The computer-implemented method of claim 13 , and further comprising setting a risk level associated with the risk event based on the indication that the resource contains sensitive information.
15. A computer-readable media having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by a computer, cause the computer to:
obtain a set of risk signature definitions, each risk signature definition, in the set of risk signature definitions, representing a corresponding risk signature;
identify a plurality of input criteria for a risk signature;
scan an event log in a cloud environment;
determine a number of matches between the plurality of input criteria and a scanned event from the event log;
detect an instance of a candidate risk event based on a determination that the number of matches exceeds a threshold;
generate result metadata indicative of the instance of the candidate risk event, the result metadata including a signature identifier that identifies the risk signature;
identify a post processing action based on the signature identifier;
execute the post processing action to obtain context information associated with the instance of the candidate risk event based on a cloud infrastructure graph that defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources; and
generate an output representing a classification of the instance of the candidate risk event as a risk event based on the context information.
16. The computer-readable media of claim 15 , wherein the computer-readable instructions, when executed, cause the computer to:
deploy a container image that includes a representation of the risk signature in the cloud environment, the container image comprising an event log scanner configured to identify a plurality of events in the event log, the plurality of events comprising one or more of:
data creation events,
data movement events,
data deletion events, or
data update events.
17. The computer-readable media of claim 16 , wherein the event log scanner is configured to perform event log scanning independent of event types.
18. The computer-readable media of claim 15 , wherein the computer-readable instructions, when executed, cause the computer to:
filter events in the event log with a set of properties, wherein the set of properties include one or more of:
resource information identifying a resource in which the event was performed,
identity information identifying an identity which performed the event, or
timestamp information identifying a time the event was performed.
19. The computer-readable media of claim 15 , wherein the context information comprises an indication that a resource, associated with the scanned event, contains sensitive information.
20. The computer-readable media of claim 19 , wherein the computer-readable instructions, when executed, cause the computer to:
set a risk level associated with the risk event based on the indication that the resource contains sensitive information.