Supplementing network flow analysis with endpoint information

A system, comprising:

• a plurality of server computer systems configured to provide a user cloud access to data of an entity via a virtual machine, wherein the server computer systems are hosted by a cloud provider other than the entity;
• wherein the server computer systems are configured to execute a cloud activity analysis agent within the virtual machine, wherein the cloud activity analysis agent is executable to:
• collect information regarding computing activity within the virtual machine, wherein the information includes one or more cryptographic hash values of processes generating network flows;
• include, in one or more network flow data records associated with the network flows, cloud activity data based on the collected information, wherein the one or more network flow data records are formatted in accordance with Internet Protocol Flow Information Export (IPFIX), and wherein the cloud activity data is included in an extended field of the one or more network flow data records;
• and
• transmit the one or more network flow data records from the virtual machine to a device for flow analysis.

A method, comprising:

• executing a cloud activity analysis agent within a virtual machine in a cloud computing environment to collect information regarding computing activity within the virtual machine in the cloud computing environment, wherein the information includes one or more cryptographic hash values for processes executing within the virtual machine and generating network flows, and wherein the cloud computing environment provides access to data of an entity;
• the cloud activity analysis agent within a virtual machine including, in one or more network flow data records regarding the network flows, cloud activity data based on the collected information, wherein the one or more network flow data records are formatted in accordance with Internet Protocol Flow Information Export (IPFIX), and wherein the cloud activity data is included in an extended field of the one or more network flow data records;
• and
• the cloud activity analysis agent transmitting the one or more network flow data records from the virtual machine to a device for flow analysis.