Context-aware security policies and incident identification via automated cloud graph building with security overlays

A system, comprising:

• a processor;
• and
• a memory device that stores program code structured to cause the processor to:
• identify a security alert for at least one of a resource or an entity represented in a graph of a computing system, the graph including graph nodes representing resources and entities of the computing system, the entities having respective associations to the resources, the graph nodes representing the entities having assigned security attributes;
• generate at least one context-aware security policy that provides one or more contextual security recommendations for the computing system based at least on a relationship between a plurality of graph nodes of the graph;
• and
• perform a security action for the computer system based on the at least one context-aware security policy.

A method in a computing device, comprising:

• identifying a security alert for at least one of a resource or an entity represented in a graph of a computing system, the graph including graph nodes representing resources and entities of the computing system, the entities having respective associations to the resources, the graph nodes representing the entities having assigned security attributes;
• identifying a security incident based at least on the security alert and a relationship between a plurality of graph nodes of the graph;
• and
• performing a security action for the computer system based at least on the identified security incident.