# US 2019/0318100 A1 · High granularity application and data security in cloud environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318100 A1 - Document ID: US20190318100A1 - Status: Published application - Kind: A1 - Application number: 16/137,315 - Filed: 2018-09-20 - Published: 2019-10-17 - Earliest claimed: 2018-04-17 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Gaurav Bhatia; Ganesh Kirti; Ramana Rao Satyasai Turlapati - Web page: https://patentgrep.com/patent/US20190318100A1 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Provided are systems, methods, and computer-readable medium for identifying security risks in applications executing in a cloud environment. In various implementations, a security monitoring and management system can obtain application data from a service provider system. The application data can include a record of actions performed by an application during use of the application by users associated with a tenant. The application executes in a service platform provided for the tenant by the service provider system. In various implementations, the application data is analyzed to identify an event associated with a security risk, where the event is identified from one or more actions performed by the application. The system can determine an action to perform in response to identifying the event. In various examples, an agent executing on the service platform can add instrumentation codes used by the application, where the instrumentation provides the application data. ## Claims ### Claim 1 A computer-implemented method, comprising, at a computer system of a security management system: obtaining application data from a service provider system, wherein the application data includes a record of actions performed by an application during use of the application by one or more users associated with a tenant, wherein the application executes in a service platform provided for the tenant by the service provider system, wherein the service provider system provides the tenant with a tenant account, and wherein the tenant account enables the one or more users to access the service platform; analyzing the application data to identify an event associated with a security risk, wherein the event is identified from one or more actions performed by the application; determining an action to perform in response to identifying the event; and performing the action. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the service provider system maintains an activity log for the tenant, the activity log including actions performed by the one or more users in accessing the service platform, and wherein the activity log does not include actions performed by the application. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the event is identified using a policy from a plurality of policies, wherein the plurality of policies define application actions associated with security risks. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the one or more actions performed by the application produce an effect on a computing resource, and wherein the policy indicates that the effect on the computing resource is a security risk. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: filtering the application data using a plurality of polices, wherein one or more policies from the plurality of policies describe application actions identified as security risks. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the event is identified using a model for the application, wherein the model describes usage patterns for the application. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein an agent executing on the service platform collects the application data and provides the application data to the computer system. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein an agent executing on the service platform modifies code used by the application to add instrumentation to the code, wherein, when the code is executed by the application, the code produces the application data. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the agent is configured to identify code that, when executing, performs actions identified as security risks. ### Claim 10 A computing system, comprising: one or more processors; and a memory coupled to and readable by the one or more processors, the memory including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: obtaining application data from a service provider system, wherein the application data includes a record of actions performed by an application during use of the application by one or more users associated with a tenant, wherein the application executes in a service platform provided for the tenant by the service provider system, wherein the service provider system provides the tenant with a tenant account, and wherein the tenant account enables the one or more users to access the service platform; analyzing the application data to identify an event associated with a security risk, wherein the event is identified from one or more actions performed by the application; determining an action to perform in response to identifying the event; and performing the action. ### Claim 11 (depends on 10) The computing system of claim 10, wherein the service provider system maintains an activity log for the tenant, the activity log including actions performed by the one or more users in accessing the service platform, and wherein the activity log does not include actions performed by the application. ### Claim 12 (depends on 10) The computing system of claim 10, wherein the event is identified using a policy from a plurality of policies, wherein the plurality of policies define application actions associated with security risks. ### Claim 13 (depends on 12) The computing system of claim 12, wherein the one or more actions performed by the application produce an effect on a computing resource, and wherein the policy indicates that the effect on the computing resource is a security risk. ### Claim 14 (depends on 10) The computing system of claim 10, wherein the memory further includes instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: filtering the application data using a plurality of polices, wherein one or more policies from the plurality of policies describe application actions identified as security risks. ### Claim 15 (depends on 10) The computing system of claim 10, wherein the event is identified using a model for the application, wherein the model describes usage patterns for the application. ### Claim 16 (depends on 10) The computing system of claim 10, wherein an agent executing on the service platform modifies code used by the application to add instrumentation to the code, wherein, when the code is executed by the application, the code produces the application data. ### Claim 17 (depends on 16) The computing system of claim 16, wherein the agent is configured to identify code that, when executing, performs actions identified as security risks. ### Claim 18 A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to: obtain application data from a service provider system, wherein the application data includes a record of actions performed by an application during use of the application by one or more users associated with a tenant, wherein the application executes in a service platform provided for the tenant by the service provider system, wherein the service provider system provides the tenant with a tenant account, and wherein the tenant account enables the one or more users to access the service platform; analyze the application data to identify an event associated with a security risk, wherein the event is identified from one or more actions performed by the application; determine an action to perform in response to identifying the event; and perform the action. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the service provider system maintains an activity log for the tenant, the activity log including actions performed by the one or more users in accessing the service platform, and wherein the activity log does not include actions performed by the application. ### Claim 20 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the event is identified using a policy from a plurality of policies, wherein the plurality of policies define application actions associated with security risks.