High-fidelity event data for multi-cloud services
Disclosed are systems, apparatuses, methods, and computer-readable media for high-fidelity event data for multi-cloud services. A method includes: storing first event information of a multi-cloud service in a cache, wherein the first event information is received from a first gateway controlled by the controller; storing second event information of the multi-cloud service in the cache, wherein the second event information is received from a first external service; mapping the second event information to the first event information to at least one identifier associated with the controller; and generating a first synthesized event information based on mapping the second event information to the first event information, the first synthesized event information including the at least one identifier, at least one event from the first event information, and at least one event from the second event information.
1 . A method of synthesizing logs from different clouds and services of a multi-cloud service, comprising:
storing first event information of the multi-cloud service in a cache, wherein the first event information is received from a first gateway controlled by a controller;
storing second event information of the multi-cloud service in the cache, wherein the second event information is received from a first external service;
mapping the second event information to the first event information by identifying a dynamic address in the first event information and associating the dynamic address with configuration information provided by the controller, wherein the configuration information includes at least one identifier associated with the first gateway; and
generating a first synthesized event information based on mapping the second event information to the first event information, the first synthesized event information including the at least one identifier, at least one event from the first event information, and at least one event from the second event information.
2 . The method of claim 1 , further comprising:
after the first synthesized event information is generated, receiving third event information from a second external service; and
updating the first synthesized event information based on information in the third event information.
3 . The method of claim 1 , further comprising:
after a period of time, storing the first synthesized event information in a storage system; and
when the first synthesized event information is stored, removing the first event information, the second event information, and the first synthesized event information from the cache.
4 . The method of claim 1 , further comprising:
retrieving supplemental information based on the first event information and the second event information, wherein the supplemental information is associated with a security assessment of a source or a destination of the first event information and the second event information; and
updating the first synthesized event information based on the supplemental information.
5 . The method of claim 4 , wherein the second event information is applied to a second synthesized event information that has a timestamp that is before a timestamp of the first synthesized event information and a third synthesized event information that has a timestamp that is after the timestamp of the first synthesized event information.
6 . The method of claim 1 , further comprising:
generating a security recommendation based on synthesized event information.
7 . The method of claim 1 , wherein the first synthesized event information identifies at least one security policy applied to the first gateway.
8 . A computing device for performing a function, comprising:
at least one memory; and
at least one processor coupled to the at least one memory and configured to:
store first event information of a multi-cloud service in a cache, wherein the first event information is received from a first gateway controlled by a controller;
store second event information of the multi-cloud service in the cache, wherein the second event information is received from a first external service;
map the second event information to the first event information by identifying a dynamic address in the first event information and associating the dynamic address with configuration information provided by the controller, wherein the configuration information includes at least one identifier associated with the first gateway; and
generate a first synthesized event information based on mapping the second event information to the first event information, the first synthesized event information including the at least one identifier, at least one event from the first event information, and at least one event from the second event information.
9 . The computing device of claim 8 , wherein the at least one processor is configured to:
after the first synthesized event information is generated, receive third event information from a second external service; and
update the first synthesized event information based on information in the third event information.
10 . The computing device of claim 8 , wherein the at least one processor is configured to:
after a period of time, store the first synthesized event information in a storage system; and
when the first synthesized event information is stored, remove the first event information, the second event information, and the first synthesized event information from the cache.
11 . The computing device of claim 8 , wherein the at least one processor is configured to:
retrieve supplemental information based on the first event information and the second event information, wherein the supplemental information is associated with a security assessment of a source or a destination of the first event information and the second event information; and
update the first synthesized event information based on the supplemental information.
12 . The computing device of claim 11 , wherein the second event information is applied to a second synthesized event information that has a timestamp that is before a timestamp of the first synthesized event information and a third synthesized event information that has a timestamp that is after the timestamp of the first synthesized event information.
13 . The computing device of claim 8 , wherein the at least one processor is configured to:
generate a security recommendation based on synthesized event information.
14 . The computing device of claim 8 , wherein the first synthesized event information identifies at least one security policy applied to the first gateway.
15 . A computing device for performing a function, comprising:
a storage configured to store instructions; and
a processor configured to execute the instructions and cause the processor to:
store first event information of a multi-cloud service in a cache, wherein the first event information is received from a first gateway controlled by a controller;
store second event information of the multi-cloud service in the cache, wherein the second event information is received from a first external service;
map the second event information to the first event information by identifying a dynamic address in the first event information and associating the dynamic address with configuration information provided by the controller, wherein the configuration information includes at least one identifier associated with the first gateway; and
generate a first synthesized event information based on mapping the second event information to the first event information, the first synthesized event information including the at least one identifier, at least one event from the first event information, and at least one event from the second event information.
16 . The computing device of claim 15 , wherein the processor is configured to execute the instructions and cause the processor to:
after the first synthesized event information is generated, receive third event information from a second external service; and
update the first synthesized event information based on information in the third event information.
17 . The computing device of claim 15 , wherein the processor is configured to execute the instructions and cause the processor to:
after a period of time, store the first synthesized event information in a storage system; and
when the first synthesized event information is stored, remove the first event information, the second event information, and the first synthesized event information from the cache.
18 . The computing device of claim 15 , wherein the processor is configured to execute the instructions and cause the processor to:
retrieve supplemental information based on the first event information and the second event information, wherein the supplemental information is associated with a security assessment of a source or a destination of the first event information and the second event information; and
update the first synthesized event information based on the supplemental information.
19 . The computing device of claim 15 , wherein the processor is configured to:
generate a security recommendation based on synthesized event information.
20 . The computing device of claim 15 , wherein the first synthesized event information identifies at least one security policy applied to the first gateway.