Security and compliance alerts based on content, activities, and metadata in cloud

Abstract

Correlated signals associated with one or more of stored content, content metadata, and activities associated with the stored content of a tenant may be analyzed and alert(s) determined based on alertthreshold(s) or broader "abnormal" pattern detection. Different recipients for different alerts or alert levels may be designated and the alert(s) transmitted to the designated recipients. Alerts mayalso be displayed through an alert management dashboard of a protection service. The alert(s) and the results of the analysis may also be provided to a policy engine for use in adjusting or creatingrules within a policy, alert thresholds, and signal collection / analysis. Post-fact investigations may also be initiated upon alerts.

Description

Background technique [0001] A hosted service provided by a service provider's tenants to its users (eg, a company to its employees or an organization to its members) is an increasingly common software usage model. Managed services cover a wide range of software applications and systems from cloud storage to productivity, and from collaboration to communications. Accordingly, any number of users may utilize the applications provided under the hosted service umbrella to generate, process, store, and collaborate on documents and other data. [0002] Use of such hosted services and processing of data may be subject to regulatory, legal, industry, and other rules. Different rules may apply depending on the particular service, data processed, type of organization, and many other factors. When policies are implemented for various data types and related actions, alerts can be raised in response to detected breaches or increased risk of breaches. However, traditional methods of dete...

AI Technical Summary

Problems solved by technology

However, traditional methods of detection, analysis, and alerting are often mechanistic, which can lead to false negatives or false positives

For example, the deletion of a large number of files in a tenant's cloud storage may raise an alarm, but may not necessarily indicate a threat, whereas the deletion of the same number of files with certain types of sensitive data may point to a threat

Images