Security breach detection and mitigation in a cloud-based environment

A system comprising:

• a memory;
• and
• a processing device coupled to the memory, the processing device to perform operations comprising:
• generating training data for an AI model, wherein generating the training data comprises:
• generating a training input comprising historical event data indicating one or more historical activities performed with respect to at least one of a plurality of client devices of a cloud-based environment;
• and
• generating a target output comprising:
• an indication of whether the one or more historical activities of the client devices were previously indicated by a security authority to be indicative of a historical security breach and,
• for the one or more historical activities, a corresponding mapping to one or more historical security actions initiated by the security authority at the cloud-based environment in response to the historical activity to mitigate the historical security breach;
• and
• providing the training data to train the AI model to predict activities performed with respect to the plurality of client devices that are indicative of a security breach and one or more security actions to mitigate the security breach, wherein the training data comprises (i) a set of training inputs comprising the training input and (ii) a set of target outputs comprising the target output.

A non-transitory computer readable storage medium comprising instructions for a server that, when executed by a processing device, cause the processing device to perform operations comprising:

• providing event data associated with a plurality of client devices of a cloud-based environment as input to a trained artificial intelligence (AI) model, wherein the event data indicates activities performed with respect to the plurality of client devices;
• obtaining one or more outputs of the trained AI model, the one or more outputs indicating:
• a set of activities, of the activities indicated by the event data, performed with respect to at least one of the plurality of client devices that is indicative of a security breach,
• a plurality of security actions to be taken at the cloud-based environment in response to the set of activities, and
• for each of the plurality of security actions, a level of confidence indicating a likelihood that a respective security action will successfully mitigate the security breach;
• selecting, among the plurality of security actions, a security action based on a comparison of the respective levels of confidence of the plurality of security actions;
• and
• performing a set of operations to initiate the security action at the cloud-based environment.