System and method for agentless detection of sensitive data on managed databases

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• accessing a managed database service;
• generating a snapshot from the managed database service of a cloud computing environment, the snapshot including a plurality of data files;
• detecting a first data object in the plurality of data files, the first data object including a data schema and a content;
• classifying the first data object based on the content, wherein the content is classified as sensitive data or non-sensitive data;
• generating a node on a security graph stored in a graph database to represent the first data object and the classification thereof, wherein the security graph further includes a representation of the cloud computing environment;
• detect a second data object in the plurality of data files, the second data object sharing the data schema of the first data object;
• generate in the security graph:
• a second data object node representing a second data object, and a data schema node representing the data schema;
• connecting the data schema node:
• the second data object node and the generated node in response to detecting the shared data schema;
• receiving a query to detect a node representing a data object classified as sensitive data;
• and
• render an output based on the classification and the data schema node in response to receiving a query to detect a node representing a data object classified as sensitive data.

A system for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• access a managed database service;
• generate a snapshot from the managed database service of a cloud computing environment, the snapshot including a plurality of data files;
• detect a first data object in the plurality of data files, the first data object including a data schema and a content;
• classify the first data object based on the content, wherein the content is classified as sensitive data or non-sensitive data;
• generate a node on a security graph stored in a graph database to represent the first data object and the classification thereof, wherein the security graph further includes a representation of the cloud computing environment;
• detect a second data object in the plurality of data files, the second data object sharing the data schema of the first data object;
• generate in the security graph:
• a second data object node representing a second data object, and a data schema node representing the data schema;
• connecting the data schema node:
• the second data object node and the generated node in response to detecting the shared data schema;
• receiving a query to detect a node representing a data object classified as sensitive data;
• and
• render an output based on the classification and the data schema node in response to receiving a query to detect a node representing a data object classified as sensitive data.