Cloud environment database log analyzer with risk signature detection

A computing system comprising:

• at least one processor;
• and
• memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
• detect a triggering criterion;
• in response to the triggering criterion, automatically discover a plurality of databases in a cloud environment bar accessing a cloud application programming interface (API) exposed by the cloud environment and executing a query through the cloud API that returns database identifiers that identify the plurality of databases that have logging enabled;
• configure an orchestration engine to deploy a plurality of log analyzer microservices on the plurality of databases,
• each log analyzer microservice, of the plurality of log analyzer microservices, being configured to scan a respective database log that represents database activities on a respective database of the plurality of databases;
• receive analysis results from the plurality of log analyzer microservices, the analysis results representing detection of at least one of a performance criterion or a security criterion in one or more databases of the plurality of databases;
• and
• generate an action signal representing the analysis results.

A computer-implemented method of detecting security posture of a cloud environment, the computer-implemented method comprising:

• automatically discovering a plurality of databases, in response to a triggering criterion in the cloud environment, by accessing a cloud application programming interface (API) exposed by the cloud environment and executing a query through the cloud API that returns database identifiers that identify the plurality of databases that have logging enabled;
• receiving a request to analyze a particular database, from among the plurality of databases, in the cloud environment;
• parsing, using a loci analyzer microservice from among a plurality of microservices that were deployed by an orchestration engine on the plurality of databases, a database query log corresponding to the particular database to obtain a parser result, wherein the database query log includes a set of log entries representing database queries on the particular database, and each log entry of the set of log entries identifies a requestor and a target dataset on the particular database;
• based on parsing the database query log, identifying one or more query instance that match a pre-defined risk signature;
• generating an analysis result by the log analyzer microservice representing the one or more query instance that match the pre-defined risk signature;
• and
• generating an output representing the analysis results.