Dynamic reconstruction of cloud application traffic for security monitoring

A non-transitory computer readable storage medium comprising stored instructions, the instructions when executed by one or more processors of a security system cause the security system to:

• maintain a catalog that includes API data associated with one or more APIs of one or more cloud applications, the one or more APIs are used by one or more devices of an organization to access information from one or more cloud API servers;
• collect, using one or more collectors that are each specific to a different API of the one or more APIs, network information descriptive of communications associated with the one or more cloud applications used by the one or more devices of the organization and the one or more cloud API servers, the network information including partial log data from some of the one or more collectors;
• generate an enriched reconstruction of API network traffic using at least the partial log data and the catalog;
• determine security information that identifies a security risk using the enriched reconstruction of API network traffic;
• and
• provide the security information to an administrator device of the organization.

A security system comprising:

• one or more processors;
• and
• a non-transitory computer readable storage medium coupled to the one or more processors and comprising stored instructions that, when executed by the one or more processors, cause the security system to:
• maintain a catalog that includes API data associated with one or more APIs of one or more cloud applications, the one or more APIs are used by one or more devices of an organization to access information from one or more cloud API servers,
• collect, using one or more collectors that are each specific to a different API of the one or more APIs, network information describing communications associated with the one or more cloud applications used by the one or more devices of the organization and the one or more cloud API servers, the network information including partial log data from some of the one or more collectors,
• generate an enriched reconstruction of API network traffic using at least the partial log data and the catalog,
• determine security information that identifies a security risk using the enriched reconstruction of API network traffic, and provide the security information to an administrator device of the organization.