Identifying unmanaged cloud resources with endpoint and network logs
Techniques and mechanisms for identifying unmanaged cloud resources with endpoint and network logs and attributing the identified cloud resources to an entity of an enterprise that owns the cloud resources. The process collects data from sources, e.g., endpoint and network logs, with respect to traffic in a computer network and based at least in part on the data, extracts relationships related to the traffic. The process applies rules to the relationships to extract destinations in the computer network that provide cloud resources in a cloud environment, wherein the cloud resources are owned by an enterprise. One or more users or business entities of the enterprise are identified as accessing the cloud resources.
1. A method comprising:
collecting, by an electronic device, first data with respect to traffic in a computer network;
based at least in part on the first data, extracting, by the electronic device, relationships related to the traffic;
applying rules to the relationships to extract destinations in the computer network that provide enterprise-owned resources in a cloud environment, wherein the enterprise-owned resources are cloud resources comprising at least one of computing instances or storage buckets located within the cloud environment and are owned by an enterprise; and
identifying, by the electronic device, (i) one or more users that are accessing the enterprise-owned resources or (ii) one or more business entities accessing the enterprise-owned resources.
2. The method of claim 1 , wherein collecting the first data comprises collecting one or more of (i) second data from logs of an endpoint monitoring application or (ii) third data from logs of a network monitoring application.
3. The method of claim 1 , wherein a monitoring application provides a list of enterprise-owned cloud resources.
4. The method of claim 1 , wherein extracting relationships comprises constructing a bipartite knowledge graph.
5. The method of claim 4 , further comprising annotating edges of the bipartite knowledge graph with information.
6. The method of claim 5 , wherein the information comprises one or more of (i) a process that initiated the traffic, (ii) an identification of a destination port, (iii) an identification of a source device, or (iv) a timestamp.
7. The method of claim 1 , wherein identifying, by the electronic device, (i) one or more users that are associated with the enterprise and accessing the enterprise-owned resources or (ii) one or more business entities that are associated with the enterprise and accessing the enterprise-owned resources comprises summarizing the enterprise-owned resources and indicating users and/or business units of the enterprise in a compact computer-readable format.
8. The method of claim 1 , wherein applying rules to the relationships comprises applying the rules using a machine learning algorithm.
9. An apparatus comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform actions comprising:
collecting, by an electronic device, first data with respect to traffic in a computer network;
based at least in part on the first data, extracting, by the electronic device, relationships related to the traffic;
applying rules to the relationships to extract destinations in the computer network that provide enterprise-owned resources in a cloud environment, wherein the enterprise-owned resources are cloud resources comprising at least one of computing instances or storage buckets located within the cloud environment and are owned by an enterprise; and
identifying, by the electronic device, (i) one or more users that are accessing the enterprise-owned resources or (ii) one or more business entities accessing the enterprise-owned resources.
10. The apparatus of claim 9 , wherein collecting the first data comprises collecting one or more of (i) second data from logs of an endpoint monitoring application or (ii) third data from logs of a network monitoring application.
11. The apparatus of claim 9 , wherein a monitoring application provides a list of enterprise-owned cloud resources.
12. The apparatus of claim 9 , wherein extracting relationships comprises constructing a bipartite knowledge graph.
13. The apparatus of claim 12 , further comprising annotating edges of the bipartite knowledge graph with information.
14. The apparatus of claim 13 , wherein the information comprises one or more of (i) a process that initiated the traffic, (ii) an identification of a destination port, (iii) an identification of a source device, or (iv) a timestamp.
15. The apparatus of claim 9 , wherein identifying, by the electronic device, (i) one or more users that are associated with the enterprise and accessing the enterprise-owned resources or (ii) one or more business entities that are associated with the enterprise and accessing the enterprise-owned resources comprises summarizing the enterprise-owned resources and indicating users and/or business units of the enterprise in a compact computer-readable format.
16. The apparatus of claim 9 , wherein applying rules to the relationships comprises applying the rules using a machine learning algorithm.
17. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform actions comprising:
collecting, by an electronic device, first data with respect to traffic in a computer network;
based at least in part on the first data, extracting, by the electronic device, relationships related to the traffic;
applying rules to the relationships to extract destinations in the computer network that provide enterprise-owned resources in a cloud environment, wherein the enterprise-owned resources are cloud resources comprising at least one of computing instances or storage buckets located within the cloud environment and are owned by an enterprise; and
identifying, by the electronic device, (i) one or more users that are accessing the enterprise-owned resources or (ii) one or more business entities accessing the enterprise-owned resources.
18. The one or more non-transitory computer-readable media of claim 17 , wherein collecting the first data comprises collecting one or more of (i) second data from logs of an endpoint monitoring application or (ii) third data from logs of a network monitoring application.
19. The one or more non-transitory computer-readable media of claim 17 , wherein a monitoring application provides a list of enterprise-owned cloud resources.
20. The one or more non-transitory computer-readable media of claim 17 , wherein extracting relationships comprises constructing a bipartite knowledge graph and the actions further comprise:
annotating edges of the bipartite knowledge graph with information,
wherein the information comprises one or more of (i) a process that initiated the traffic, (ii) an identification of a destination port, (iii) an identification of a source device, or (iv) a timestamp.