Capturing contextual information for data accesses to improve data security

A method by one or more runtime agents implemented by one or more network devices for capturing contextual information for data accesses using distributed tracing, wherein the one or more runtime agents protect a web application that is communicatively coupled to a web application firewall and a database server hosting a database monitored by a database activity monitor, the method comprising:

• determining first metadata associated with a web application layer request sent by the web application firewall to the web application, wherein the first metadata was determined by the web application firewall;
• determining second metadata associated with the web application layer request based on information available to the web application;
• storing the first metadata and the second metadata in a data storage;
• associating the first metadata and the second metadata with a trace identifier;
• and
• causing the web application to send the trace identifier to the database when the web application submits a database query to the database server to access the database as part of the web application processing the web application layer request, wherein execution of the database query by the database is to cause the database activity monitor to store third metadata associated with the database query determined by the database activity monitor in the data storage and associate the third metadata with the trace identifier.

A set of one or more non-transitory machine-readable storage media storing instructions which, when executed by one or more processors of one or more network devices implementing one or more runtime agents protecting a web application that is communicatively coupled to a web application firewall and a database server hosting a database monitored by a database activity monitor, causes the one or more network devices to perform operations for capturing contextual information for data accesses using flow enrichment, the operations comprising:

• determining first metadata associated with a web application layer request sent by the web application firewall to the web application, wherein the first metadata was determined by the web application firewall;
• determining second metadata associated with the web application layer request based on information available to the web application;
• serializing the first metadata and the second metadata to generate serialized metadata;
• and
• adding the serialized metadata to a database query that is to be submitted by the web application to the database server to access the database as part of the web application processing the web application layer request, wherein execution of the database query that includes the serialized metadata by the database server is to cause the database activity monitor to store the serialized metadata and third metadata associated with the database query determined by the database activity monitor in a data storage.

A set of one or more non-transitory machine-readable storage media storing instructions which, when executed by one or more processors of one or more network devices implementing one or more runtime agents protecting a web application that is communicatively coupled to a web application firewall and a database server hosting a database monitored by a database activity monitor, causes the one or more network devices to perform operations for capturing contextual information for data accesses using distributed tracing, the operations comprising:

• determining first metadata associated with a web application layer request sent by the web application firewall to the web application, wherein the first metadata was determined by the web application firewall;
• determining second metadata associated with the web application layer request based on information available to the web application;
• storing the first metadata and the second metadata in a data storage;
• associating the first metadata and the second metadata with a trace identifier;
• and
• causing the web application to send the trace identifier to the database when the web application submits a database query to the database server to access the database as part of the web application processing the web application layer request, wherein execution of the database query by the database is to cause the database activity monitor to store third metadata associated with the database query determined by the database activity monitor in the data storage and associate the third metadata with the trace identifier.

A network device configured to implement a runtime agent that protects a web application that is communicatively coupled to a web application firewall and a database server hosting a database monitored by a database activity monitor, wherein the runtime agent is configured to capture contextual information for data accesses using flow enrichment, the network device comprising:

• one or more processors;
• and
• a non-transitory machine-readable storage medium having instructions stored therein, which when executed by the one or more processors, causes the network device to:
• determine first metadata associated with a web application layer request sent by the web application firewall to the web application, wherein the first metadata was determined by the web application firewall,
• determine second metadata associated with the web application layer request based on information available to the web application,
• serialize the first metadata and the second metadata to generate serialized metadata, and
• add the serialized metadata to a database query that is to be submitted by the web application to the database server to access the database as part of the web application processing the web application layer request, wherein execution of the database query that includes the serialized metadata by the database server is to cause the database activity monitor to store the serialized metadata and third metadata associated with the database query determined by the database activity monitor in a data storage.

A network device configured to implement a runtime agent that protects a web application that is communicatively coupled to a web application firewall and a database server hosting a database monitored by a database activity monitor, wherein the runtime agent is configured to capture contextual information for data accesses using distributed tracing, the network device comprising:

• one or more processors;
• and
• a non-transitory machine-readable storage medium having instructions stored therein, which when executed by the one or more processors, causes the network device to:
• determine first metadata associated with a web application layer request sent by the web application firewall to the web application, wherein the first metadata was determined by the web application firewall,
• determine second metadata associated with the web application layer request based on information available to the web application,
• store the first metadata and the second metadata in a data storage,
• associate the first metadata and the second metadata with a trace identifier, and
• cause the web application to send the trace identifier to the database when the web application submits a database query to the database server to access the database as part of the web application processing the web application layer request, wherein execution of the database query by the database is to cause the database activity monitor to store third metadata associated with the database query determined by the database activity monitor in the data storage and associate the third metadata with the trace identifier.