Cloud-based threat detection

A computing system of a security management system, comprising:

• one or more processors;
• and
• a memory coupled to and readable by the one or more processors, the memory including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• obtaining activity data from a first service provider system, wherein the activity data describes first actions performed at a first point in time during use of a first cloud service, wherein the first actions are performed by one or more user devices associated with a tenant, wherein the first service provider system provides the tenant with a tenant account, and wherein the tenant account enables the one or more user devices to access the first cloud service;
• determining, from the activity data, a first event that occurred during use of the first cloud service;
• determining that the first event is associated with a security rule configured for the tenant, wherein the security rule includes a sequence of events and a threshold, wherein, when the network security system determines that a number of events from the sequence of events have occurred and the number of events exceeds the threshold, that a security violation has occurred, and wherein, at the first point in time, the number of events includes the first event and the number of events is less than the threshold;
• storing, in non-volatile memory, a first timestamp associated the first event;
• obtaining additional activity data from a second service provider system, wherein the additional activity data describes second actions performed at a second point in time during use of a second cloud service and wherein the second point in time is after the first point in time;
• determining, from the additional activity data, a second event that occurred during use of the second cloud service;
• determining that the second event is associated with the security rule, wherein, at a time after the second point in time, the number of events includes the first event and the second event, and wherein the number of events exceeds the threshold;
• storing, in non-volatile memory, a second timestamp associated the second event;
• and
• determining, based on the first timestamp and the second timestamp, one or more security actions to perform in response to determining that the number of events exceeds the threshold, wherein the one or more security actions include modifying a security control associated with the first cloud service or the second cloud service;
• and
• performing the one or more security actions.

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors of a computing system of a security management system, cause the one or more processors to perform operations comprising:

• obtaining activity data from a first service provider system, wherein the activity data describes first actions performed at a first point in time during use of a first cloud service, wherein the first actions are performed by one or more user devices associated with a tenant, wherein the first service provider system provides the tenant with a tenant account, and wherein the tenant account enables the one or more user devices to access the first cloud service;
• determining, from the activity data, a first event that occurred during use of the first cloud service;
• determining that the first event is associated with a security rule configured for the tenant, wherein the security rule includes a sequence of events and a threshold, wherein, when the network security system determines that a number of events from the sequence of events have occurred and the number of events exceeds the threshold, that a security violation has occurred, and wherein, at the first point in time, the number of events includes the first event and the number of events is less than the threshold;
• storing, in non-volatile memory, a first timestamp associated the first event;
• obtaining additional activity data from a second service provider system, wherein the additional activity data describes second actions performed at a second point in time during use of a second cloud service and wherein the second point in time is after the first point in time;
• determining, from the additional activity data, a second event that occurred during use of the second cloud service;
• determining that the second event is associated with the security rule, wherein, at a time after the second point in time, the number of events includes the first event and the second event, and wherein the number of events exceeds the threshold;
• storing, in non-volatile memory, a second timestamp associated the second event;
• and
• determining, based on the first timestamp and the second timestamp, one or more security actions to perform in response to determining that the number of events exceeds the threshold, wherein the one or more security actions include modifying a security control associated with the first cloud service or the second cloud service;
• and
• performing the one or more security actions.