Cloud Risk Event Detection Using Log Scanners and Infrastructure Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in understanding data posture and access control within cloud environments, making it difficult to identify which users have access to sensitive data and potential vulnerabilities, both internally and externally.
Innovation Solution
A cloud security posture analysis system that deploys an event log scanner to detect candidate risk events using risk signature definitions, classifies these events based on context information from a cloud infrastructure graph, and generates metadata for risk event classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If an event log scanner is deployed to detect candidate risk events using risk signature definitions, then the detection capability of risk events is improved, but the complexity of the system increases due to the need for cloud infrastructure graphs and context information processing
Solution Approach 1:
The system is divided into distinct functional modules: an event log scanner that detects candidate risk events using risk signature definitions, a cloud infrastructure graph component that stores context information, and a classification component that integrates both data sources. This segmentation allows each module to specialize in specific tasks, improving detection precision while managing complexity through modular design.
Solution Approach 2:
The cloud infrastructure graph serves as an intermediary data structure that bridges the event log scanner and the classification process. It stores context information about cloud resources, relationships, and configurations, enabling the system to enrich candidate risk events with relevant context without requiring direct complex interactions between all system components.
2Measurement precision
If context information from cloud infrastructure graph is obtained for each detected instance, then the accuracy of risk event classification is improved, but the time and computational resources required increase
Solution Approach 1:
The cloud infrastructure graph is pre-populated with context information about cloud resources, their relationships, configurations, and metadata before risk event detection occurs. This preliminary action ensures that when candidate risk events are detected, the classification component can quickly retrieve relevant context information without performing time-consuming queries or computations during the actual classification process.
Solution Approach 2:
The system replaces traditional mechanical querying and analysis methods with a graph-based data structure that enables efficient traversal and retrieval of context information. The cloud infrastructure graph allows the system to quickly resolve relationships between cloud resources, configurations, and events through graph traversal algorithms, which are more efficient than traditional hierarchical or flat data structures.
3Reliability
If the system classifies candidate risk events as risk events based on context information, then the reliability of security posture management is improved, but the device complexity increases due to multiple processing components
Solution Approach 1:
The system merges multiple data sources (event log scanner outputs, cloud infrastructure graph context information, risk signature definitions) into a unified classification process. The classification component integrates these diverse inputs to produce a comprehensive risk event classification, improving reliability by considering multiple factors simultaneously while presenting a unified interface to users.
Solution Approach 2:
The cloud infrastructure graph serves multiple functions: it stores context information for risk event classification, provides relationship data for enrichment, and supports various types of queries about cloud resource configurations. This multi-functionality reduces the need for separate specialized components, managing complexity while improving reliability through a versatile core data structure.
Data Source
AI summary
The technology disclosed relates to a system and method for detecting risk events in a cloud environment that obtains a set of risk signature definitions and deploys an event log scanner to the cloud environment. The event log scanner is configured to detect instances of candidate risk events in accordance with the set of risk signature definitions based on a scan of an event log and to label each detected instance with a signature identifier. Result metadata is received indicative of the detected instances. A cloud infrastructure graph is accessed that defines nodes that represent resources in the cloud environment and edges, between the nodes, that represent relationships between the resources. Context information is derived from the cloud infrastructure graph based on the result metadata. An output is generated representing a classification of one or more of the detected instances of candidate risk events as a risk event based on the context information relative to the set of risk signature definitions.