Security incident detection based on historian configuration data collected over time

A method, comprising:

• updating historic configuration data associated with a computing device based on received configuration data indicative of a change in configuration of the computing device in a computer system, the historic configuration data indicating changes to configurations of the computing device over a time period;
• determining, based on the updated historic configuration data, that a relationship between the computing device and an entity of the computer system has changed;
• providing the updated historic configuration data as input to a machine learning (ML) model configured to generate an indication of whether the updated historic configuration data evidences a security incident;
• and
• in response to the ML model generating an indication that the updated historic configuration data evidences a security incident, generating a security alert indicative of the evidenced security incident.

A computer-readable storage medium having programming instructions encoded thereon that are executable by one or more processors to perform a method, the method comprising:

• updating historic configuration data associated with a computing device based on received configuration data indicative of a change in configuration of the computing device in a computer system, the historic configuration data indicating changes to configurations of the computing device over a time period;
• determining, based on the updated historic configuration data, that a relationship between the computing device and an entity of the computer system has changed;
• providing the updated historic configuration data as input to a machine learning (ML) model configured to generate an indication of whether the updated historic configuration data evidences a security incident;
• and
• in response to the ML model generating an indication that the updated historic configuration data evidences a security incident, generating a security alert indicative of the evidenced security incident.