Session analysis for identity posture management and security

A system comprising:

• a memory comprising instructions;
• and
• one or more computer processors, the instructions, when executed by the one or more computer processors, causing the system to perform operations comprising:
• receiving telemetry signals from a plurality of entities in a session environment, wherein the session environment includes at least one identity of a user engaged with respective applications via respective meta sessions;
• determining an underlying trail for each meta session, the underlying trail being fragmented across two or more sessions with two or more entities in the plurality of entities;
• and
• for a first meta session with a first application associated with the identity of the user, perform operations comprising:
• correlating a signal hierarchy based on the telemetry signals;
• constructing, based on the correlated signal hierarchy, a session hierarchy underlying the first meta session distributed across the plurality of entities;
• determining a posture of the first meta session based on the constructed session hierarchy;
• and
• enforcing a security policy based on the determined posture.

A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:

• receiving telemetry signals from a plurality of entities in a session environment, wherein the session environment includes at least one identity of a user engaged with respective applications via respective meta sessions;
• determining an underlying trail for each meta session, the underlying trail being fragmented across two or more sessions with two or more entities in the plurality of entities;
• and
• for a first meta session with a first application associated with the identity of the user, perform operations comprising:
• correlating a signal hierarchy based on the telemetry signals;
• constructing, based on the correlated signal hierarchy, a session hierarchy underlying the first meta session distributed across the plurality of entities;
• determining a posture of the first meta session based on the constructed session hierarchy;
• and
• enforcing a security policy based on the determined posture.