Techniques for forensic tracing of suspicious activity from cloud computing logs

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for tracing suspicious activity to a workload based on a forensic log, the process comprising:

• detecting in at least one cloud log of a cloud computing environment a plurality of events, each event indicating an action in the cloud computing environment;
• extracting from an event of the plurality of events an identifier of a first cloud entity, wherein the event includes an action which is predetermined as indicative of a suspicious event;
• traversing an already existing security graph to detect a node representing the first cloud entity, wherein the security graph further includes a representation of the cloud computing environment, the security graph including a node for at least one resource of the cloud computing environment and a node for at least one principal of the cloud computing environment and, further including at least one node representing an enrichment;
• detecting that the node representing the first cloud entity is connected to a node representing a cybersecurity vulnerability;
• traversing the security graph to detect a node representing a secret connected to the node representing the first cloud entity;
• detecting a node representing a second cloud entity connected to the node representing the secret;
• determining that the second cloud entity is compromised, and
• when the node representing the first cloud entity is connected to the node representing the cybersecurity vulnerability, initiating a mitigation action for the second cloud entity based on the cybersecurity vulnerability.

A system for tracing suspicious activity to a workload based on a forensic log, comprising:

• a processing circuitry;
• and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• detect in at least one cloud log of a cloud computing environment a plurality of events, each event indicating an action in the cloud computing environment;
• extract from an event of the plurality of events an identifier of a first cloud entity, wherein the event includes an action which is predetermined as indicative of a suspicious event;
• traverse an already existing security graph to detect a node representing the first cloud entity, wherein the security graph further includes a representation of the cloud computing environment, the security graph including a node for at least one resource of the cloud computing environment and a node for at least one principal of the cloud computing environment, and further including at least one node representing an enrichment;
• detect that the node representing the first cloud entity is connected to a node representing a cybersecurity vulnerability;
• traverse the security graph to detect a node representing a secret connected to the node representing the first cloud entity;
• detect a node representing a second cloud entity connected to the node representing the secret;
• determine that the second cloud entity is compromised;
• and
• when the node representing the first cloud entity is connected to the node representing the cybersecurity vulnerability, initiate a mitigation action for the second cloud entity based on the cybersecurity vulnerability.