Security map hierarchical engine in security management system

Abstract

Methods, systems, and computer storage media for providing security event management using a security map tiering engine in a security management system. Security event management is provided using a security map hierarchy engine that includes a multi-layer security map that supports querying the security map using a multi-layer representation of data associated with the security map. In operation, a security map associated with a plurality of security resources in a cloud environment is accessed. A multi-layer security map is generated based on the access security map. The multilayer security map is a multilayer representation of security. And deploying the multi-layer security map. A security query associated with the multi-layer security map is accessed. And executing the security query based on the multi-layer security map, and executing the security query to generate a query result. The query results are transmitted to a security event management client to cause a secure query result display.

Description

BACKGROUND

[0001] Users rely on computing environments with applications and services to accomplish computing tasks. Distributed computing systems host and support different types of applications and services in a managed computing environment. In particular, a computing environment can implement a security management system that provides security incident management functionality and supports threat protection in the computing environment. For example, cloud security posture management (CSPM) can include identifying and remediating risks through automated visibility, performing continuous monitoring and threat detection, and providing remediation workflows to search for misconfigurations across various cloud computing environments and infrastructures. SUMMARY

[0002] Various aspects of the technology described herein generally relate to systems, methods, and computer storage media for providing security incident management using, among other things, a security graph layering engine of a security management system. Security incident management supports security management of a computing environment based on a multi-layered security graph of agent representations as security graphs. The security graphs operate as centralized security services that provide a uniform application programming interface (API) to access security-related information, and the multi-layered security graph supports querying the security graph using multi-layered representations (i.e., a configuration layer, a presentation layer, and a query layer) of data associated with the security graph.

[0003] The multi-layered security graph refers to a representation of a security graph that supports providing security query responses for security queries in a computing environment. The multi-layered security graph is programmatically constructed and derived based at least in part on the security graph. The multi-layered security graph is generated based on selectively integrating security graph data into the configuration layer, the presentation layer, and the query layer of the multi-layered security graph. The security graph layering engine operates to provide a security graph layering model that processes security graph data using security graph layering operations to generate the multi-layered security graph.

[0004] The security incident management engine can access the multi-layered security graph to process security queries and generate query results. For example, a security administrator can investigate ongoing threats in a computing environment based on security queries for security incident management information that is provided using the configuration layer, the presentation layer, and the query layer. The security incident management information in the multi-layered security graph is generated based on security graph layering operations that optimize query results to security graph queries that include the security incident management information.

[0005] Generally, security management systems are not configured with comprehensive computational logic and infrastructure to effectively provide adequate security query responses. For example, a security graph in a computing environment is capable of storing security information and providing access to the security information in a manner that makes querying the security graph for security query responses complex and computationally expensive. Security management systems with such security graphs lack integration with security graph layering operations. Moreover, determining security incident management information based on a single layer representation of security data - without additional layers of data representation - can result in inadequate functionality of the security management system as the user interface query experience is diminished and retrieving security graph data and causing presentation of query results requires considerable computational resources.

[0006] Technical solutions to the limitations of conventional security management systems can include the following challenges: generating a multi-layer security graph based on a security graph; generating query results for security queries using the multi-layer security graph that includes a configuration layer, a presentation layer, and a query layer; and providing security management operations and interfaces via a security graph layering engine that supports security incident management in the security management system. As such, a security management system can be improved based on security graph layering operations that generate a multi-layer security graph as a particular type of data structure designed to improve the way the security management system stores and retrieves security data; and the security graph layering operations also generate query results in order to summarize and provide security incident management information for a computing environment in a particular manner.

[0007] In operation, a security query associated with a multi-layer security graph is accessed. The multi-layer security graph is a proxy representation of a security graph associated with a plurality of security resources in a cloud computing environment. The multi-layer graph includes a plurality of layers that include selectively integrated security graph data associated with the security graph, the plurality of layers including a configuration layer, a presentation layer, and a query layer. The security query is executed based on the multi-layer security graph, where executing the security query includes generating query results for the security query. Each of the plurality of layers supports a use case associated with the security query used to generate the query results. The query results are transmitted to cause generation of the security query on a security incident client.

[0008] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to determine the scope of the claimed subject matter. BRIEF DESCRIPTION OF DRAWINGS

[0009] The technology described herein is described below in detail with reference to the following figures. FIG. 1A and FIG. 1B is a block diagram of an example security management system including a security graph layering engine in accordance with aspects of the technology described herein; FIGS. 1C-1Gis an exemplary security map layering diagram of a multi-layer security map in accordance with aspects of the technology described herein; FIG. 2A is a block diagram of an exemplary security management system including a security map layering engine in accordance with aspects of the technology described herein; FIG. 2B is a block diagram of an exemplary security management system including a security map layering engine in accordance with aspects of the technology described herein; FIG. 3 A first exemplary method of providing security event management using a security map layering engine in accordance with aspects of the technology described herein is provided; FIG. 4 A second exemplary method of providing security event management using a security map layering engine in accordance with aspects of the technology described herein is provided; FIG. 5 A third exemplary method of providing security event management using a security map layering engine in accordance with aspects of the technology described herein is provided; FIG. 6 A block diagram of an exemplary distributed computing environment suitable for implementing aspects of the technology described herein is provided; and FIG. 7 is a block diagram of an exemplary computing environment suitable for implementing aspects of the technology described herein. DETAILED DESCRIPTION

[0010] SUMMARY Security management systems support management of security aspects of resources and workloads in computing environments. Security management systems can help enable protection against threats, help reduce risk across different types of computing environments, and help strengthen the security posture of computing environments, i.e., the security state and remediation action recommendations for computing resources including networks and devices. For example, security management systems can provide real-time security alerts, centralized insights into different resources, and provide preventive protection, post-breach detection and automated investigation, and response.

[0011] Traditionally, security management systems are not configured with comprehensive computing logic and infrastructure to effectively provide adequate security query responses in computing environments. For example, a security map in a computing environment can include information and store information in a way that makes querying the security map for security query responses complex and computationally expensive. Security management systems with such security maps lack integration with security map layering operations. Moreover, determining security event management information based on a single layer representation of security data - without additional layers of data representation - can result in under-functionality of the security management system as the user interface query experience is diminished and retrieving security map data and causing presentation of query results requires considerable computing resources.

[0012] By way of illustration, a conventional security management system can include a security graph that stores data based on entity-based static operational characteristics. For example, a network security group (NSG) can be connected to a plurality of subnets and network interface controllers (NICs), where changes in the NSG can result in observable changes in the plurality of subnets and NICs based on identifying traffic flowing through the plurality of subnets and NICs. In this way, the NSG in the conventional security management system can define a plurality of edges that uniquely indicate the NSG configuration or impact the plurality of subnets or NICs. However, attack scenarios can involve impacting the configuration of the plurality of subnets or NICs that affect the NSG. Such configurations can not be queryable in the security management system that does not provide alternative configuration data with a hierarchical data representation.

[0013] Further, conventional security management systems can provide security data with details that make performing certain queries computationally expensive. For example, answering the query: "get VMs exposed to the internet" can be challenging. The plurality of combinations of connections between computing components (e.g., first instance: (internet) -> (IP address) -> (load balancer) -> (VM); second instance: (internet) -> (IP address -> (VM); and third instance: (internet) -> (IP address) -> (application load balancer) -> (elastic compute instance)) would have to be generated and provided in different queries to determine the answer, which can require a large amount of computing resources.

[0014] Further, security query responses can also include data that is not specifically relevant to the type of security question or security query because conventional security graphs can include non-critical entities. Ignoring the irrelevant data that is not associated with the security query can include a certain complexity in generating the security query, which makes the user interface experience deficient and computationally expensive when executed. As such, a more comprehensive security management system - with alternative foundations for performing security management operations - can improve the computational operations and interface in the security management system.

[0015] Embodiments of the present technical solution relate to systems, methods, and computer storage media for providing security event management using a security graph layering engine of a security management system, among other things. Security event management supports security management of a computing environment based on a multi-layered security graph that is represented as a proxy of a security graph. The security graph operates as a centralized security service that provides a uniform application programming interface (API) to access security-related information, and the multi-layered security graph supports querying the security graph using a multi-layered representation (i.e., a configuration layer, a presentation layer, and a query layer) of data associated with the security graph. Security event management is provided using a security graph layering engine that is operatively integrated into the security management system. The security management system supports a security graph layering framework of computing components that is associated with generating a multi-layered security graph based on the security graph and generating query results for security queries using the multi-layered security graph that includes the configuration layer, the presentation layer, and the query layer.

[0016] The multi-layered security graph refers to a representation of the security graph that supports providing security query responses for security queries in a computing environment. The multi-layered security graph is programmatically constructed and derived based at least in part on the security graph. The multi-layered security graph is generated based on selectively integrating security graph data into the configuration layer, the presentation layer, and the query layer of the multi-layered security graph. The security graph layering engine operates to provide a security graph layering model that processes security graph data using security graph layering operations to generate the multi-layered security graph.

[0017] The security event management engine can access the multi-layered security graph to process security queries and generate query results. For example, a security administrator can investigate ongoing threats in a computing environment based on security queries for security event management information that is provided using the configuration layer, the presentation layer, and the query layer. The security event management information in the multi-layered security graph is generated based on security graph layering operations that optimize querying the security graph for query results that include the security event management information.

[0018] At a high level, the security management system supports communicating any security issues to cloud computing platform customers in its cloud computing environment. The security management system is configured to trigger alerts in the computing environment for potential or actual threats, including suspicious or malicious behavior. For example, an alert configuration can be defined to include alert settings that, if satisfied, trigger an alert. The security alert can refer to a human-readable technical notification about current vulnerabilities, exploits, and other security issues associated with the computing environment. The alert can be communicated to a client device that is managed by a security administrator, who can then follow up on the alert.

[0019] There are different types of potential and actual threats, for example, using a proxy to access a computing environment or running crypto-mining software without authorization in a computing environment. For example, an attack on a cloud computing environment performed by a malicious actor can include several attack operations performed to gain access to resources on the cloud computing environment. When a security management system is configured to monitor these types of attack operations, the attack operations can trigger alerts. If multiple attack operations are identified, and it is determined that the attack operations are related, the alerts associated with the attack operations can be defined as a security incident. A security incident can refer to a collection of related alerts and corresponding security data that make up an attack story. Security incidents can combine multiple alerts associated with a single attack to support managing and responding to security incidents.

[0020] An attack story can be associated with a security graph and an attack path definition that identifies attack objects (e.g., attack operations, compromised resources, file locations, and file types). The attack path definition can describe how an attacker gained access to a computing environment and related operations and computing resources associated with the attack and unauthorized access. Attack path analysis - using graph-based algorithms - scans a cloud security graph to identify exploitable paths that an attacker can use to compromise a computing environment. Attack path analysis exposes attack paths, suggests remediation actions that can disrupt the attack path against the problem, and prevents successful compromise.

[0021] A security graph (e.g., MICROSOFT SMART SECURITY GRAPH) can be provided as a component that provides telemetry data associated with multiple resources in a computing environment. The security graph can implement machine learning to generate actionable security alerts and recommendations. The security graph can be associated with an application programming interface (API) that operates as an intermediary service to access shared patterns of aggregated security information from multiple security providers in a computing environment. In this way, the security graph and security graph API can support integration of security alerts from different security providers via an API connector that streams alerts to a security management system.

[0022] In practice, providing a security query response using only a security graph can be challenging. As context, a security graph can be configured to connect to different types of services and devices to provide access to security data including security graph data. Accessing security data via a security graph provides different perspectives for analyzing and developing insights from security data associated with the security graph. A security graph can not be optimally configured to efficiently and sufficiently support various types of queries performed against the security graph in performing analytics. For example, a query to determine "which users have access to a database" can bypass contextual data relevant to understanding the query results from the security graph; and also bypass contextual data relevant to additional investigation and remediation actions. For example, the query results cannot include group names of groups associated with granting the users access to the database, and cannot identify users that would be impacted if the group access was removed.

[0023] Further, retrieving this type of contextual data, if performed on the security graph, can be expensive. In particular, a query performed on the graph would increase complexity and consume significant computing resources and time to provide query results and additional contextual data for the query. By way of illustration, a query would have to include query parameters that account for users having 1 to n group memberships up to the assignment of access, and further account for users obtaining access from different mechanisms, and that the access can be granted via multiple architectural models and technologies.

[0024] A security graph layering engine supports generating a multi-layer security graph as a proxy representation of a security graph. The multi-layer security graph is an optimized representation of the security graph that corresponds to different use cases of a configuration layer, a presentation layer, and a query layer. Each layer can be structured in an optimized manner for queries corresponding to the use cases associated with the respective layers. In this manner, a type of security query (e.g., a type of security information requested) can be determined, and based on the security query, a security query response is generated using one or more layers of the multi-layer graph. Unlike security management systems that provide security data in only one layer, the multi-layer security graph supports use cases based on different layers and combinations of layers utilized in parallel. As discussed in more detail below, the layers can be generated based on security graph layering operations.

[0025] Referring to the configuration layer, the configuration layer is a data store layer that stores data associated with entities in the configuration layer. The configuration layer can store data corresponding to cloud configuration data of one or more entities in a cloud computing environment. The entities are mapped to configuration objects that are affected by the configuration data corresponding to the entity. In this manner, if a change is made to the configuration data associated with an entity, impacted configuration objects of the entity can be identified. Further, remediation plans for attack scenarios can be managed (e.g., generated, analyzed, and implemented) based on information retrieved from the configuration layer. Hierarchically, the configuration layer can be the lowest representation layer.

[0026] In operation, raw data is retrieved from data sources associated with one or more entities. The one or more entities are mapped to nodes on a configuration layer, and references between entities are mapped to edges. The direction of the edges is from the referencing entity to the referenced entity. As an example, permissions can be given based on 4 entities (e.g., role definition, role assignment, identity, and scope), so each instance of a permission corresponds to a node. The role definition, identity, and scope do not reference (and are not associated with any other entities), so no additional edges are generated for the role definition, identity, or scope. However, each role assignment involves the role definition, identity, and scope, so edges are generated from each reference (i.e., role assignment to role definition; role assignment to identity; and role assignment to scope).

[0027] The presentation layer is an attack graph presentation layer. In particular, the presentation layer can be used to generate a graphical representation of a potential attack graph that is transmitted to a security management client for display. The presentation layer can include a directed graph. The directed graph can be configured to store attack analysis data. For example, the attack analysis data can specifically provide information about how a first entity can access (or connect) to a second entity (sometimes via one or more intermediary entities). The attack analysis data can be used as a starting point for investigation and remediation against a threat.

[0028] In operation, configuration layer data from the configuration data is retrieved to generate a presentation layer and presentation layer data. In particular, one or more attack paths are identified in the configuration layer, where a first node should reach a second node based on the attack path walk - however, based on the configuration data, the second node cannot be reached via the first node. The presentation layer supports three presentation layer operations: remove-add operation, set edge direction operation, and merge nodes operation. More specifically, remove any nodes that represent a restriction on the attack path walk, and add them as data on the edges; set the direction of the edges to be the direction of the security attack; and merge nodes that always create a 1 : 1 connection.

[0029] As such, with respect to the permissions example, the role definition is removed because it contains a set of permissions that the identity can perform, which does not change the existence of the permissions. Then, the direction of the edge - from the role assignment to the role definition - is changed so that an attack walk from the identity to the scope can occur. Finally, the role assignment is removed because each instance will always have a 1 : 1 link between a particular instance of the identity and a particular instance of the scope. Thus, the presentation layer for this segment is provided as: (identity) -> (scope).

[0030] The query layer is the response generator layer. In particular, the query layer is configured to answer abstract questions in an efficient manner. In one implementation, to reduce query complexity, only a subset of entities (e.g., key entities) are provided in the query layer. In this way, data that is not relevant to security-oriented questions and queries is not included in the query layer. For example, VMs, storage, and users can exist in the query layer; however, storage folders, Kubernetes pods, and load balancers as logical containers can be removed. A user (e.g., an administrator of the cloud computing environment) can transmit (e.g., via the security management client) a query for an attack scenario rather than listing multiple possible combinations of entities that can have an impact.

[0031] In operation, the query layer is simplified based on a plurality of query layer operations. By way of illustration, a schema definition operation supports defining schemas on the representation layer that are to be abstracted into the query layer. For example, (user) -[is a member of]-> (group) -[is a member of]-> (group) -[has permissions]-> (cloud computing subscription) -[contains]-> (resource group) -[contains]-> (VM).

[0032] A function definition operation supports converting representation layer schemas into query layer schemas. In the above example, a function would check whether the permission definition for each node results in (user) having permissions to a particular entity (e.g., a VM).

[0033] A schema matching operation can be performed using a schema matching algorithm on the graph to detect matches for each defined schema. For each match, a function application operation is performed to apply the function (i.e., the function definition operation) and create a single query layer edge where applicable. In this way, only those schemas that are represented in a walkable path (source node -> [destination node] are considered, while the remaining nodes are abstracted away. The resulting graph will contain walkable edges between key entities, while intermediate edges and nodes are abstracted away.

[0034] Advantageously, embodiments of the technical solution include several inventive features (e.g., operations, systems, engines, and components) associated with a security management system having a security graph layering engine. The security graph layer engine supports security graph layer operations including generating a multi-layer security graph based on a security graph; generating query results for a security query using the multi-layer security graph including a configuration layer, a representation layer, and a query layer; and providing security management operations and interfaces via a security graph layering engine that supports security event management in the security management system. The security graph layer operations are solutions to specific problems in security management (e.g., how to store and retrieve security data for a security query). The multi-layer graph provides a data structure for storing and retrieving security information in a way that improves computing operations in the security management system. Further, the large amount of security information stored for a cloud computing system can be summarized and presented in specific ways to improve the user interface of the security management system.

[0035] Example Systems and Operations Aspects of the technical solution can be described by way of example and with reference to FIGS. 1A-1F FIG. 1A A cloud computing environment (system) 100 and a security management system 100A are shown. The security management system 100A includes a network 100B, a security graph layering engine 110 having a multi-layer security graph 170, a security event management engine 120 having a security event graph API 122, a security management client 130 having a security event management client 132 and security event interface data 134; and a security graph 140.

[0036] The cloud computing environment 100 provides computing system resources for different types of managed computing environments. For example, the cloud computing environment 100 supports the delivery of computing services including servers, storage, databases, networking, and security intelligence. A plurality of security management clients (e.g., the security management client 130) includes hardware or software that accesses resources in the cloud computing environment 100. The security management client 130 can include an application or service that supports client-side functionality associated with the cloud computing environment 100. The plurality of security management clients can access computing components of the cloud computing environment 100 via a network (e.g., the network 100B) to perform computing operations.

[0037] ​The security management system 100A is designed to provide security event management using the security graph layering engine 110. The security management system 100A provides an integrated operating environment for a security management framework based on computing components associated with generating a multi-layer security graph based on a security graph and generating query results for security queries using the multi-layer security graph having a configuration layer, a presentation layer, and a query layer. The security management system 100A integrates security graph layering operations - generating a configuration layer, a presentation layer, and a query layer based on data associated with a security graph - into security management operations and interfaces to effectively provide security event information and security posture information, as well as remediation information, for a computing environment. For example, a security administrator can investigate ongoing threats in a computing environment based on security queries for security event management information provided using the configuration layer, the presentation layer, and the query layer. The security event management information is a multi-layer security graph generated based on security graph layering operations that optimize query results for security queries that include the security event management information.

[0038] The security graph layering engine 110 is responsible for generating a multi-layer security graph 170 based on security graph layering operations. The multi-layer security graph 170 can be transmitted to the security event management engine 120 to support providing security event management. For example, the security event management engine 120 can use the multi-layer security graph 170 to execute security queries to generate query results that can be incorporated into security event management functions. Specifically, a security event can evaluate a security query (e.g., based on information requested by the security query) and identify one or more layers in the multi-layer graph that should be used to execute the security query to identify security event management information. Query results including the security event information can be identified using the multi-layer security graph and transmitted to the security management client 130. In this way, the security graph layering engine 110 operates with security management system components (e.g., the security event management engine 120) to provide security event management.

[0039] The security event management engine 120 is responsible for communicating with the security management client 130 having a security event management client 132 and security event interface data 134. The security event management client 132 supports client-side security event management operations for providing security management in the security management system. The security event management client 132 can support generating the multi-layer graph 170, transmitting security queries to generate query results, presenting security posture visualizations including the query results, and transmitting indications to perform remediation actions for alerts associated with security events. As such, the security event interface data 134 can include data associated with the security graph layering engine 110 and data associated with the security event management engine 120 that can be transmitted between the security graph layering engine 110, the security event management engine 120, and the security management client 130.

[0040] The security event management engine 120 operates to provide visibility into the security state of resources in a computing environment. Security posture information can be associated with network, data, and identity resources of the computing environment. The security posture information can include security event management information as described herein. The security posture information can specifically include query results associated with security queries performed using the multi-layer security graph 170. The security event management engine 120 includes a security graph API 122 that provides access to the security graph 140 and security graph data. The security graph 140 provides telemetry data associated with a plurality of resources in the computing environment. In particular, the telemetry data can be security data associated with security providers in the computing environment. The security graph 140 and the security graph API 122 can support integration of security alerts from different security providers via an API connector that streams the alerts to the security event management engine 120.

[0041] The security event management engine 120 can also support generating a security posture visualization based on security posture information including query results from security queries performed on the multi-layer security graph 170, security data for attack path analysis, alerts, and security events, and security event management information. For example, the security posture visualization can provide the query results as the security posture information. The security posture visualization can specifically identify the query results based on a particular layer of the multi-layer security graph 150 associated with the query results.

[0042] The security management client 130 can support accessing and causing display of the security posture visualization. The security management client 130 can include a security event management client 132 that supports receiving security event interface data 134 from the security management system 110A and causing presentation of the security event interface data 134. The security event interface data 134 can specifically include the security posture visualization associated with the security event. The security posture visualization can also include remediation actions associated with different alerts, including the alert associated with the security event.

[0043] The security management client 130 can also support performing remediation actions. In particular, the security posture visualization can include remediation actions for the alert associated with the security event. The security management client 130 can receive an indication to perform the remediation actions associated with the security event. Based on receiving the indication to perform the remediation actions, the security management client 130 can transmit an indication to perform the remediation actions to cause performance of the remediation actions.

[0044] As such, query results can be more efficiently generated based on the multi-tiered security graph 170 and provided with remediation actions that can be selected and transmitted to cause the remediation actions to be performed. The remediation actions can address actual or potential threats associated with security events and alerts. For example, the remediation actions can include offloading a computing device, disabling a user, quarantining a file, shutting down an external email, or running an anti-virus scan. Other variations and combinations of security posture visualizations with security events, alerts, and remediation actions are contemplated with the embodiments described herein.

[0045] Referring to FIG. 1B , FIG. 1B A security graph tiering engine 110, a security graph tiering graph model 150 with security graph tiering operations 152, a security graph tiering data API 160, and a multi-tiered security graph 170 with a configuration tier 172, a representation tier 174, and a query tier 176 are shown.

[0046] The security graph tiering model 150 is a computational model that supports generating a multi-tiered security graph. The computational model is configured to access security data and generate a multi-tiered security graph as a representation of the security graph. The computational model supports programmatically building security data and exporting it into a multi-tiered security graph 170 with a configuration tier 172, a representation tier 174, and a query tier 176. The security graph tiering model can include security graph tiering operations that are executed to generate the different tiers of the multi-tiered security graph 170. The security graph tiering operations can specifically include operations associated with generating each tier of the multi-security graph (i.e., the configuration tier, the representation tier, and the query tier). The security graph tiering engine 110 can also include a security graph tiering data API that supports retrieving different types of security data and accessing the security graph to perform the security graph tiering operations 152 to generate the multi-tiered security graph 170.

[0047] The security graph layering operations can include operations for generating the configuration layer 172, the representation layer 174, and the query layer 176. To generate the configuration layer 172, raw data of one or more entities of the cloud computing system is retrieved. The one or more entities are mapped to nodes on the configuration layer, and references between entities are mapped to edges. To generate the representation layer, configuration layer data from the configuration data is retrieved to generate the representation layer and representation layer data. In particular, one or more attack paths are identified in the configuration layer, where a first node should reach a second node based on the attack path - however, based on the configuration data, the second node cannot be reached via the first node. The representation layer supports three representation layer operations: a remove-add operation, a set direction of edge operation, and a merge nodes operation. And to generate the query layer, a schema definition operation supports defining schemas on the representation layer to be abstracted to the query layer, a function definition operation supports converting representation layer schemas to query layer schemas, a schema matching operation supports using a pattern matching algorithm on the graph to detect matches for each defined schema, and a function application operation supports creating individual query layer edges. The operations support generating a query layer graph containing walkable edges between key entities, without considering intermediate edges or nodes.

[0048] Reference is made to FIG. 1C , FIG. 1C A security graph layering diagram 102_C is shown with multiple nodes including: role assignments 110_C, role definitions 112_C, identities 114_C, and scopes 116_C. 102_C is a schematic representation of the assignment of permissions in a cloud computing system. Permissions can be given based on the 4 entities (i.e., role assignments 110_C, role definitions 112_C, identities 114_C, and scopes 116_C). Role definitions 112_C, identities 114_C, and scopes 116_C do not reference (and are not associated with) other entities, so no additional edges are generated for those entities. However, each role assignment 110_C involves a role definition 112_C, an identity 114_C, and a scope 116_C.

[0049] Reference is made to FIG. 1D , FIG. 1D A plurality of diagrams are shown, including a security graph layering diagram 102_C with multiple nodes including: role assignments 110_C, role definitions 112_C, identities 114_C, and scopes 116_C. Role definitions 112_C are removed 110_D. Role definitions 112_C are removed because they contain a set of permissions that an identity can perform, so they do not affect the existence of permissions. In the security graph layering diagram 104_D, the direction of the edge 120_D from role assignment 110_D to identity 114_C is reversed. Thus, it is possible to launch an attack route from the identity scope.

[0050] In the security graph layering illustration 106_D, the role assignment 114_C is removed 130_D. Each instance of a role assignment will always have a 1:1 link between a specific instance of an identity and a specific instance of a scope, and no additional information is added. Also, after performing the security graph layering operation, the security graph layering illustration 108_D leaves a presentation layer with identities 114_C and scopes 116_C and edge directions 130_D from identities 114_C to scopes 116_C.

[0051] Reference is made to FIG. 1E , FIG. 1F and FIG. 1G , FIG. 1E A security graph layering illustration 102_E is shown with multiple nodes in the configuration layer. In the configuration layer, the security graph layering illustration 102_E includes all relevant native entities for assigning user permissions to several resources through membership. The direction of the edges is based on the original data, from the referencing entity to the referenced entity.

[0052] FIG. 1F A security graph layering illustration 102_F is shown with multiple nodes in the presentation layer. In the presentation layer, the security graph layering illustration 102_F allows routes from any possible attacker entity to any possible attacked entity. This information can be visually determined - showing how permissions are granted, and which links can be removed to block possible attacks.

[0053] FIG. 1G A security graph layering illustration 102_G is shown with multiple nodes in the query layer. The security graph layering illustration 102_G also allows routes from any possible attacker entity to any possible attacked entity; however, with only single hops. Example security queries can be efficiently generated (e.g., "which user can access a VM" or "which groups have permissions to a subscription").

[0054] Aspects of the technical solution can be described by way of example and with reference to FIG. 2A and FIG. 2B . FIG. 2A is a block diagram of an example technical solution environment for an example environment for implementing embodiments of the illustrated technical solution described with reference to FIG. 6 and FIG. 7 . Generally, the technical solution environment includes a technical solution system suitable for providing an example cloud computing system 100 in which the methods of the present disclosure can be employed. Specifically, FIG. 2A A high-level architecture of a cloud computing system 100 according to an implementation of the present disclosure is shown. In addition to other engines, managers, generators, selectors, or components (collectively referred to herein as "components") that are not shown, the technical solution cloud computing system 100 corresponds to FIG. 1A and FIG. 1B .

[0055] Referring to FIG. 2A , FIG. 2A A security management system 100A is shown having a security graph layering engine 110, a security event management engine 120, and a security management client 130 having a security event management client 132 and a security event interface data 134, and a security graph 140. The security layering engine 110 includes a security graph layering model 150 and a multi-layer security graph 170 having a configuration layer 172, a manifestation layer 174, and a query layer 176.

[0056] The security graph layering engine 110 is responsible for generating and deploying a multi-layer security graph 170 for generating query results. The security graph layering engine accesses a security graph 140 associated with a plurality of security resources in a computing environment. The security graph 140 is a centralized service that provides a unified API to access security data associated with a plurality of security resources. Accessing the security graph includes accessing security data that is selectively integrated into a particular layer of the multi-layer security graph 170.

[0057] The security graph layering engine 110 generates a multi-layer graph as a proxy representation of the security graph. The security graph layering engine 110 can employ a security graph layering model and security graph layering operations to generate the multi-layer graph. The multi-layer graph includes a configuration layer 172, a manifestation layer 174, and a query layer 176. The configuration layer 172 stores cloud configuration data associated with one or more entities in a cloud computing environment. The entities are mapped to configuration objects that are affected by the configuration data corresponding to the entity. Changes associated with remediation actions of a security event can correspond to configuration data of an entity in the configuration layer. The entity is mapped to one or more configuration objects that are affected by the configuration data and any changes to the configuration data identified in the remediation action.

[0058] The manifestation layer 176 is an attack graph manifestation layer that includes a directed graph having a first entity connected to a second entity based on an attack path. A potential attack graph is generated based on the manifestation layer, where the attack path associated with a security event is generated based on the manifestation layer. The attack path includes a first entity connected to a second entity based on an attack path. The query layer 176 is a response generator layer that includes a path between a source node entity and a destination node entity based on a pattern that abstracts one or more entities. A single query layer edge is generated between the source node entity and the destination node entity based on a pattern definition associated with the query layer. The multi-layer security graph 170 can be deployed when generating the multi-layer security graph 170.

[0059] The security event management engine 120 is responsible for generating query results for security queries using the multi-tiered security graph 170. The security event management engine 120 accesses a security query associated with the multi-tiered security graph 170. The security query can explicitly or implicitly include information identifying one or more tiers in the multi-tiered security graph that should be used to perform the security query. The multi-tiered security graph is a proxy representation of security. The multi-tiered graph includes a plurality of tiers that include selectively integrated security graph data associated with the security graph. Each tier is associated with a set of tier generation operations used to identify the multi-tiered graph data corresponding to each tier.

[0060] The security event management engine 120 performs the security query based on the multi-tiered security graph. Performing the security query can include determining that the security query is associated with one or more tiers of the multi-tiered security graph such that the security query is performed based on the one or more tiers associated with the security query. Performing the security query includes generating a query result for the security query. The security event management engine 120 can transmit the query result. The query result can be transmitted to cause generation of the query result on a security management client. The security event management engine 120 can also support generation of a security posture visualization that includes the query result.

[0061] The security management client 130 is responsible for causing display of a security posture visualization that includes the query result. The security management client 130 can transmit a request for security posture information for a computing environment. Based on the request, a security posture visualization can be received. The security posture visualization includes the query result associated with the security query. The query result is associated with a remediation action that is performable to address a security threat associated with the query result.

[0062] Referring to FIG. 2B , FIG. 2B A cloud computing system is shown having a security graph tiering engine 110, a security management client 130, and a security event management engine 120.

[0063] At block 10, the security graph tiering engine 110 accesses a security graph associated with a plurality of security resources. The plurality of security resources can be associated with one or more computing environments including a cloud computing environment or an on-premise computing environment. At block 12, the security graph tiering engine 110 generates a multi-tiered security graph based on the security graph; generating the multi-tiered security graph includes: at block 12A, performing a configuration tier generation operation; at block 12B, performing a presentation tier generation operation; and at block 12C, performing a query tier generation operation. At block 14, the security graph tier engine deploys the multi-tiered security graph to support generation of query results for security queries.

[0064] At block 16, the security management client 130 transmits a security query including a request for a security posture for the computing environment. At block 18, the security event management engine 120 accesses the security query associated with the multi-layered security graph; at block 20, the security query is executed based on the multi-layered security graph to generate a query result for the security query; and at block 22, the query result for the security query is generated. At block 24, the security event management engine 120 transmits a security posture visualization, the security posture visualization including the query result associated with the security event. At block 26, the security management client receives the security posture visualization associated with the security event based on the security query; and at block 28, a display of the security posture visualization is caused.

[0065] Example method Referring to FIG. 3 , FIG. 4 and FIG. 5 , a flowchart illustrating a method for providing security event management using a security graph layering engine in a security management system is provided. The method can be performed using the security management system described herein. In embodiments, one or more computer storage media have computer-executable or computer-usable instructions embodied thereon that, when executed by one or more processors, can cause the one or more processors to perform a method (e.g., a computer-implemented method) in a security management system (e.g., a computerized system).

[0066] Turning to FIG. 3 , a flowchart illustrating a method 300 for providing security event management using a security graph layering engine in a security management system is provided. At block 302, a security graph associated with a plurality of security resources is accessed. At block 304, based on accessing the security graph, a multi-layered security graph is generated, where the multi-layered security graph is a multi-layered representation of the security graph. At block 306, the multi-layered security graph is deployed to support generation of a query result for a security query. At block 308, a security query associated with the multi-layered security graph is accessed. At block 310, the security query is executed based on the multi-layered security graph to generate a query result for the security query. At block 312, the query result associated with the multi-layered security graph is transmitted.

[0067] Turning to FIG. 4 , a flowchart illustrating a method 400 for providing security event management using a security graph layering engine in a security management system is provided. At block 402, a security graph associated with a plurality of security resources is accessed. At block 404, based on accessing the security graph, a multi-layered security graph is generated, the multi-layered graph being a multi-layered representation of the security. At block 406, the multi-layered security graph is deployed to support generation of a query result for a security query.

[0068] Turning to FIG. 5, a flowchart showing a method 500 for providing security event management using a security graph layering engine in a security management system is provided. At block 503, a security query associated with a multi-layer security graph is accessed. At block 504, the security query is executed based on the multi-layer graph to generate a query result for the security query. At block 506, the query result associated with the multi-layer security graph is transmitted to a security management client to cause display of the query result.

[0069] TECHNICAL IMPROVEMENTS Embodiments of the application have been described with reference to several inventive features (e.g., operations, systems, engines, and components) associated with a security management system. The described inventive features include: operations, interfaces, data structures, and arrangements of computing resources associated with providing functionality described herein with reference to a security graph layering engine. The functionality of embodiments of the application has been further described by way of implementation and auxiliary examples to demonstrate that the operations for providing a security graph layering engine as a solution to particular problems in security management technology improve computing operations in a security management system. For example, three different layers of security data are used to generate a multi-layer security graph that is strategically and selectively used to generate query results for security queries. In sum, these improvements result in less CPU computation, less memory requirements, and increased flexibility in a security management system when compared to prior conventional security management system operations performed for similar functionality.

[0070] Additional Support for the Specific Implementation Example Distributed Computing System Environment Reference is now made to FIG. 6 , FIG. 6 An example distributed computing environment 600 in which embodiments of the present disclosure can be employed is shown. In particular, FIG. 6 A high-level architecture of an example cloud computing platform 610 that can host a technical solution environment or a portion thereof (e.g., a data trustee environment) is shown. It should be appreciated that such and other arrangements described herein are set forth merely as examples. For example, as described above, many of the elements described herein can be implemented as discrete or distributed components, or in combination with other components, and in any suitable combination and location. Other arrangements and elements (e.g., machines, interfaces, functions, order, and groupings of functions) can be used in addition to or instead of those shown.

[0071] A data center can support a distributed computing environment 600 that includes a cloud computing platform 610, racks 620, and nodes 630 (e.g., computing devices, processing units, or blades) in the racks 620. The technical solution environment can be implemented with a cloud computing platform 610 that runs cloud services across different data centers and geographic regions. The cloud computing platform 610 can implement a fabric controller 640 component for resource allocation, deployment, upgrade, and management of cloud services. Generally, the cloud computing platform 610 is used to store data or run service applications in a distributed manner. The cloud computing infrastructure 610 in a data center can be configured to host and support operations of endpoints of a particular service application. The cloud computing infrastructure 610 can be a public cloud, a private cloud, or a dedicated cloud.

[0072] The nodes 630 can be equipped with a host 650 (e.g., an operating system or a runtime environment) that runs a defined software stack on the node 630. The nodes 630 can also be configured to perform specialized functions (e.g., compute nodes or storage nodes) within the cloud computing platform 610. The nodes 630 are assigned to run one or more portions of a service application of a tenant. A tenant can refer to a customer that utilizes resources of the cloud computing platform 610. Service application components of the cloud computing platform 610 that support a particular tenant can be referred to as a multi-tenant infrastructure or a tenancy. The terms service application, application, or service can be used interchangeably herein and refer broadly to any software or portion of software that is run on top of a data center or accesses storage and compute device locations within a data center.

[0073] When more than one individual service application is being supported by a node 630, the node 630 can be partitioned into virtual machines (e.g., virtual machine 652 and virtual machine 654). A physical machine can also run individual service applications concurrently. The virtual machines or physical machines can be configured as individualized computing environments supported by resources 660 (e.g., hardware resources and software resources) in the cloud computing platform 610. It is contemplated that resources can be configured for a particular service application. Further, each service application can be partitioned into functional portions such that each functional portion is capable of running on a separate virtual machine. In the cloud computing platform 610, multiple servers can be used to run service applications and perform data storage operations in a cluster. In particular, the servers can independently perform data operations but are open as a single device referred to as a cluster. Each server in the cluster can be implemented as a node.

[0074] A client device 680 can link to a service application in the cloud computing platform 610. The client device 680 can be any type of computing device, which can correspond to the computing devices 680 described with reference to FIG. 1. The client device 680 can be a mobile device, a desktop computer, a laptop computer, a server, or any other type of computing device. FIG. 6The computing device 600 described, e.g., the client device 680, can be configured to issue commands to the cloud computing platform 610. In embodiments, the client device 680 can communicate with the service application through a virtual Internet Protocol (IP) and a load balancer or other means of directing communication requests to a designated endpoint in the cloud computing platform 610. Components of the cloud computing platform 610 can communicate with each other by a network (not shown), which can include, without limitation, one or more local area networks (LANs) and / or wide area networks (WANs).

[0075] Example Computing Environment Having briefly described an overview of embodiments of the present technology solution, an example operating environment in which embodiments of the present technology solution can be implemented is described below in order to provide an overall context for aspects of the present technology solution. Reference is first made to FIG. 6 , which specifically shows an example operating environment for implementing embodiments of the present technology solution, and which is generally designated as computing device 600. Computing device 600 is but one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the technology solution. Neither should computing device 700 be interpreted as having any dependency or requirement relating to any one or combination of components illustrated.

[0076] The technology solution can be described in the general context of computer code or machine-useable instructions, including computer-executable instructions such as program modules, being executed by a computer or other machine, such as a personal data assistant or other handheld device. Generally, program modules including routines, programs, objects, components, data structures, and the like, refer to code that performs particular tasks or implements particular abstract data types. The technology solution can be practiced in a variety of system configurations, including hand-held devices, consumer electronic devices, general- purpose computers, more specialty computing devices, and the like. The technology solution can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.

[0077] Referring to FIG. 7 , the computing device 700 includes a bus 710 that directly or indirectly couples the following devices: memory 712, one or more processors 714, one or more presentation components 716, input / output ports 718, input / output components 720, and an illustrative power supply 722. Bus 710 represents what can be one or more busses (such as an address bus, data bus, or combination thereof). Alternatively, the components could be coupled by a FIG. 7 various blocks of the figure are shown with lines that represent some of the possible interconnections between the components. Other arrangements can be possible having more, or fewer components in FIG. 7FIG. 1 is merely an illustration of an example computing device that can be used with one or more embodiments of the present technology solutions. No distinction is made between FIG. 7

[0078] Computing device 700 typically includes a variety of computer-readable media. Computer-readable media is any available media that can be accessed by computing device 700 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer-readable media can comprise computer storage media and communication media.

[0079] Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be accessed by computing device 700. Computer storage media does not include signals per se.

[0080] Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of the any of the above should also be included within the scope of computer readable media.

[0081] Memory 712 includes computer storage media in the form of volatile and / or nonvolatile memory. The memory can be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid state memory, hard drives, optical drives, etc. Computing device 700 includes one or more processors that read data from various entities such as memory 712 or I / O components 720. Presentation component(s) 716 present data indications to a user or other device. Exemplary presentation components include a display device, speaker, printing component, vibrating component, etc.

[0082] ​I / O ports 718 allow computing device 700 to be logically coupled to other devices including I / O components 720, some of which can be built in. Illustrative components, modules, and functions can include a microphone, joystick, game pad, satellite dish, scanner, printer, wireless device, etc.

[0083] Additional Structural and Functional Features of Embodiments of the Technical Solution Having identified various components utilized herein, it should be understood that any number of components and arrangements can be employed to implement the desired functionality within the scope of the present disclosure. For example, for conceptual clarity, the components of the embodiments depicted in the figures are shown in line form. Other arrangements can also be implemented. For example, although some components are depicted as single components, many of the elements described herein can be implemented as discrete or distributed components or combined with other components and implemented in any suitable combination and location. Some elements can be omitted entirely. Further, various functions described herein as being performed by one or more entities can be carried out by hardware, firmware, and / or software as described below. For example, various functions can be carried out by a processor executing instructions stored in memory. As such, other arrangements and elements (e.g., machines, interfaces, functions, orders, and groupings of functions) can be used in addition to or instead of those shown, and some elements can be utilized only in a subset of embodiments.

[0084] Embodiments described in the following paragraphs can be combined with one or more of the specifically described alternatives. In particular, claimed embodiments can contain references to more than one other embodiment. Claimed embodiments can specify other limitations of the claimed subject matter.

[0085] The subject matter of embodiments of the technology is described with specificity herein to meet statutory requirements. However, the description itself is not intended to limit the scope of this patent. Rather, the inventors have contemplated that the claimed subject matter might also be embodied in other ways, to include different steps or combinations of steps in order to achieve the same goals. In addition, although the terms “step” and / or “block” can be used herein to connote different elements of methods employed, the terms should not be interpreted as implying any particular order among or between various steps herein disclosed unless and except when the order of individual steps is explicitly described.

[0086] For purposes of this disclosure, the word "including" has the same broad meaning as the word "comprising," and the word "accessing" includes "receiving," "referencing," or "retrieving." Furthermore, the word "communication" has the same broad meaning as the words "receiving" or "transmitting" facilitated by software or hardware-based buses, receivers, or transmitters using the communication media described herein. In addition, words such as "a" and "one" encompass both the singular and the plural, unless otherwise indicated. Thus, for example, the constraint of "a feature" is satisfied where there is one or more features. Furthermore, the term "or" includes conjunctive, disjunctive, and both (a or b therefore includes a or b as well as a and b).

[0087] For purposes of the detailed discussion above, embodiments of the present technology are described with reference to a distributed computing environment; however, the distributed computing environment depicted herein is merely exemplary. Components can be configured for performing novel aspects of embodiments, where the term "configured for" can refer to "programmed to" perform a particular task or implement a particular abstract data type using code. Furthermore, while embodiments of the present technology can generally refer to the technological environment and diagrams described herein, it should be understood that the described technology can extend to other implementation contexts.

[0088] Embodiments of the present technology have been described with respect to specific embodiments thereof, which are intended to be illustrative, and not limiting, in all respects. Alternative embodiments will become apparent to those of ordinary skill in the art without departing from the scope of the present technology.

[0089] From the foregoing, it will be apparent that the technology is well adapted to attain all the ends and objectives hereinabove set forth, together with other advantages which will become apparent to those of ordinary skill in the art, and which are not particularized hereinabove.

[0090] It should be understood that certain features and subcombinations are of utility and can be employed without reference to other features or subcombinations. This is contemplated by and is within the scope of the claims.

Claims

1. A computerized system, comprising: One or more computer processors; as well as A computer memory storing computer-usable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations, the operations including: Access (302) the security graph associated with multiple security resources; Generate (304) a multi-layer graph as a proxy representation of the security graph, the multi-layer graph including a configuration layer, a presentation layer and a query layer; Deploy the multi-layer graph described in (306) to support the generation of query results for secure queries; Access (308) security queries associated with the multi-layer security graph; Executing the security query (310) based on the multi-layer security graph, wherein executing the security query includes generating query results for the security query; and Transmit the query results described in (312).

2. The system of claim 1, wherein the plurality of security resources are associated with one or more computing environments associated with the security graph. The security graph is a centralized service that provides a unified application programming interface to access security data associated with the plurality of security resources, wherein accessing the security graph includes accessing the security data that is selectively integrated into the configuration layer, the presentation layer, and the query layer of the multi-layer security graph.

3. The system of claim 1, wherein the configuration layer stores cloud configuration data associated with one or more entities in the cloud computing environment, wherein the entities are mapped to configuration objects affected by the configuration data corresponding to the entities.

4. The system of claim 1, wherein the presentation layer is an attack graph presentation layer comprising a directed graph, the directed graph comprising a first entity, the first entity being connected to a second entity based on an attack path.

5. The system of claim 1, wherein the query layer is a response generator layer, the response generator layer comprising a path between a source node entity and a destination node entity based on a pattern that abstracts one or more entities.

6. The system of claim 1, wherein the change associated with the remedial action of the security incident corresponds to the configuration data of an entity in the configuration layer, wherein the entity is mapped to one or more configuration objects affected by the configuration data.

7. The system of claim 1, wherein the potential attack graph is generated based on the presentation layer; wherein the attack path associated with the security event is generated based on the presentation layer, the attack path including a first entity connected to a second entity based on the attack path.

8. The system according to claim 1, wherein the operation further comprises: A request for the security posture of the computing environment is transmitted from the security management client; Based on the request, a security posture visualization associated with the computing environment is received, wherein the security posture visualization includes the query results; as well as This results in the display of the security posture visualization, including the query results.

9. The system of claim 1 further includes a security event management engine, the security event management engine supporting the generation of security posture visualization, the security posture visualization including query results associated with remediation actions, wherein the remediation actions are executable to handle security threats associated with the query results.

10. One or more computer storage media having computer-executable instructions thereon, which, when executed by a computing system having a processor and a memory, cause the processor to perform operations, the operations including: Access (502) a security query associated with a multi-layer security graph, wherein the multi-layer security graph is a proxy representation of a security graph associated with multiple security resources; Execute the security query (504) based on the multi-layer security graph, wherein executing the security query includes generating query results for the security query; as well as Transmit (506) query results to cause the generation of the query results on the security management client.

11. The medium of claim 10, wherein the multi-layer graph comprises a configuration layer, a presentation layer, and a query layer. The configuration layer stores cloud configuration data associated with one or more entities in the cloud computing environment, wherein the entities are mapped to configuration objects affected by the configuration data corresponding to the entities; The representation layer is an attack graph representation layer comprising a directed graph, the directed graph including a first entity, the first entity being connected to a second entity based on an attack path; and The query layer is a response generator layer, which includes paths between source node entities and destination node entities based on patterns that abstract one or more entities.

12. The medium of claim 10, wherein the change associated with a remedial action for a security incident corresponds to configuration data of an entity in the configuration layer, wherein the entity is mapped to one or more configuration objects affected by the configuration data; The potential attack graph is generated based on the presentation layer; the attack path associated with the security event is generated based on the presentation layer, and the attack path includes a first entity connected to a second entity based on the attack path; and A single query layer edge is generated between the source node entity and the destination node entity based on the schema definition associated with the query layer.

13. The medium of claim 10, wherein performing the security query further comprises identifying one or more layers of the multi-layer security, the one or more layers supporting the generation of query results of the type requested in the security query, wherein the security query explicitly or implicitly identifies the one or more layers used to perform the security query.

14. A computer-implemented method, the method comprising: Access (402) the security graph associated with multiple security resources; Generate a (404) multi-layer graph as a proxy representation of the security graph, the multi-layer graph including a configuration layer, a presentation layer, and a query layer; and Deploy the multi-layer graph described in (406) to support the generation of query results for secure queries.

15. The method according to claim 14, further comprising: Access security queries associated with multi-layered security graphs; The security query is executed based on the multi-layer security graph, wherein executing the security query includes generating query results for the security query; as well as Transmit the query results.

Images