Data-aware anomaly detection

A resource management system, comprising:

• one or more memories;
• and
• one or more processors, wherein the one or more memories store code comprising instructions executable, individually or collectively, by the one or more processors to cause the resource management system to:
• determine, for a computing environment comprising a plurality of data sources, a plurality of locations of a type of data that is present in different locations across the plurality of data sources;
• obtain a first plurality of activity logs from a first data source of the plurality of data sources and a second plurality of activity logs from a second data source of the plurality of data sources, wherein the first plurality of activity logs have a first format and capture activity information associated with the first data source, and wherein the second plurality of activity logs have a second format and capture activity information associated with the second data source;
• convert, based at least in part on obtaining the first plurality of activity logs and the second plurality of activity logs, the first plurality of activity logs and the second plurality of activity logs to a normalized format to obtain a plurality of normalized activity logs;
• associate, based at least in part on the plurality of locations determined for the type of data, the plurality of normalized activity logs with the type of data to obtain a plurality of supplemented activity logs;
• and
• identify, based at least in part on the plurality of supplemented activity logs, anomalous activity in the computing environment, the anomalous activity associated with the type of data being accessed in the first data source, the type of data being accessed in the second data source, or both.

A non-transitory, computer-readable medium storing code that comprises instructions that are executable, individually or collectively, by one or more processors of a resource management system to cause the resource management system to:

• determine, for a computing environment comprising a plurality of data sources, a plurality of locations of a type of data that is present in different locations across the plurality of data sources;
• obtain a first plurality of activity logs from a first data source of the plurality of data sources and a second plurality of activity logs from a second data source of the plurality of data sources, wherein the first plurality of activity logs have a first format and capture activity information associated with the first data source, and wherein the second plurality of activity logs have a second format and capture activity information associated with the second data source;
• convert, based at least in part on obtaining the first plurality of activity logs and the second plurality of activity logs, the first plurality of activity logs and the second plurality of activity logs to a normalized format to obtain a plurality of normalized activity logs;
• associate, based at least in part on the plurality of locations determined for the type of data, the plurality of normalized activity logs with the type of data to obtain a plurality of supplemented activity logs;
• and
• identify, based at least in part on the plurality of supplemented activity logs, anomalous activity in the computing environment, the anomalous activity associated with the type of data being accessed in the first data source, the type of data being accessed in the second data source, or both.