Detection and aggregation of suspicious cloud provider entity behavior

A system, comprising:

• a processing device;
• and
• a memory to store instructions that, when executed by the processing device, cause the processing device to:
• obtain indications of events associated with user accounts of a cloud provider;
• generate scores for the events based on the indications of the events and previous occurrences of the events associated with the user accounts of the cloud provider;
• aggregate a subset of the scores for a user account in the user accounts based on each score in the subset of scores meeting a threshold score and a subset of the events corresponding to the subset of the scores occurring with a time period;
• and
• output an indication that the user account is compromised based on the aggregated subset of the scores.

A non-transitory computer readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to:

• obtain indications of events associated with user accounts of a cloud provider;
• generate scores for the events based on the indications of the events and previous occurrences of the events associated with the user accounts of the cloud provider;
• aggregate a subset of the scores for a user account in the user accounts based on each score in the subset of scores meeting a threshold score and a subset of the events corresponding to the subset of the scores occurring with a time period;
• and
• output, by the processing device, an indication that the user account is compromised based on the aggregated subset of the scores.