Process for automated investigation of flagged users based upon previously collected data and automated observation on a go-forward basis

A method for detecting anomalous user interactions with a hosted computing environment, the method comprising:

• identifying a triggering event that initiates an investigation of a user of a hosted computing environment;
• obtaining first event data that are indicative of first data access operations executed by the hosted computing environment on the behalf of the user prior to the triggering event;
• obtaining second event data that are indicative of second data access operations executed by the hosted computing environment on behalf of the user after the triggering event;
• identifying a security risk, the security risk based on analysis of past interactions of the user;
• determining a metric based on the security risk of the user;
• adjusting the metric based on an identified change in the security risk of the user;
• generating a security risk model based on the first event data and the security risk, the security risk model including the metric determined based on the identified change in the security risk of the user, and the security risk model configured to predict how the user will access data using the hosted computing environment after the triggering event;
• identifying, based on the security risk model including the metric determined based on an identified change in the security risk of the user and the second event data, a change in a pattern of data access operations executed by the hosted computing environment on the behalf of the user;
• and
• generating a security alert based on the change the pattern of data access operations.

A non-transitory machine-readable medium comprising instructions, which when executed by a machine, causes the machine to perform operations comprising:

• receiving a request to monitor data access operations executed by user of an endpoint device, the data access operations comprising causing the endpoint device to execute an operation to access data objects hosted by a storage resource that is coupled to the endpoint device;
• obtaining first event data from the endpoint device, the first event data comprising information that is indicative of first data access operations executed by the user of the endpoint device prior to receiving the request;
• obtaining second event data from the endpoint device, the second event data comprising information that is indicative of second access operations executed by the user of the endpoint device after receiving the request;
• identifying a security risk, the security risk based on analysis of past interactions of the user;
• determining a metric based on the security risk of the user;
• adjusting the metric based on an identified change in the security risk of the user;
• determining, based on the first event data and the second event data, whether a deviation between the first data access operations and the second data access operations satisfies an indicated criteria, the indicated criteria including the metric determined based on the identified change in the security risk of the user;
• and
• generating a security alert based on the determination.