Cloud service usage risk analysis based on user location

A system for filtering detected anomalies in usage activities at a cloud-based service associated with users of an enterprise, comprising:

• a computer processor configured to:
• monitor cloud usage activities from activity logs of users accessing the cloud-based service on behalf of the enterprise;
• detect a plurality of anomalies in the usage activities from the activity logs, the anomalies indicating potential security risk associated with usage activities at the cloud-based service;
• identifying from the cloud usage activities a plurality of locations from which the users accessed the cloud-based service on behalf of the enterprise, the locations being physical locations;
• perform a trusted location analysis using a trusted location registry on each of the plurality of identified locations to designate each location as a trusted location or a non-trusted location;
• filter the plurality of detected anomalies based on the identified locations being designated as a trusted location or a non-trusted location;
• perform an action based on the filtered detected anomalies, comprising generating reports or alerts based on the filtered detected anomalies having locations designated as non-trusted locations;
• and
• a memory coupled to the processor and configured to provide the processor with instructions,
• wherein the computer processor is further configured to:
• access the trusted location registry containing existing trusted locations associated with the users;
• for each identified location used by a user, determine whether the identified location matches one of the existing trusted locations for the user in the trusted location registry;
• in response to the determining that the identified location matches the existing trusted locations for the user in the trusted location registry, designate the identified location as a trusted location;
• in response to the determining that the identified location does not match the existing trusted locations for the user in the trusted location registry, determine whether the identified location matches one of known locations associated with the enterprise, the user, or peers of the user associated with the enterprise;
• in response to the determining that the identified location matches the known locations, designate the identified location as a trusted location and adding the identified location to the trusted location registry as an existing trusted location for the user;
• in response to the determining that the identified location does not matched the known locations, evaluate the identified location using one or more trusted location criteria to designate the identified location as a trusted location or a non-trusted location;
• in response to the evaluating that the identified location is a trusted location, designate the identified location as a trusted location and adding the identified location to the trusted location registry as an existing trusted location for the user;
• and
• in response to the evaluating that the identified location is not a trusted location, designate the identified location as a non-trusted location.

A computer program product for filtering detected anomalies in usage activities at a cloud-based service associated with users of an enterprise, the computer program product being embodied in a tangible and non-transitory computer readable storage medium and comprising computer instructions for:

• monitoring cloud usage activities from activity logs of users accessing the cloud-based service on behalf of the enterprise;
• detecting a plurality of anomalies in the usage activities from the activity logs, the anomalies indicating potential security risk associated with usage activities at the cloud-based service;
• identifying from the cloud usage activities a plurality of locations from which the users accessed the cloud-based service on behalf of the enterprise, the locations being physical locations;
• performing a trusted location analysis using a trusted location registry on each of the plurality of identified locations to designate each location as a trusted location or a non-trusted location;
• filtering the plurality of detected anomalies based on the identified locations being designated as a trusted location or a non-trusted location;
• and
• performing an action based on the filtered detected anomalies, comprising generating reports or alerts based on the filtered detected anomalies having locations designated as non-trusted locations,
• wherein the computer program product further comprises computer instructions for:
• accessing the trusted location registry containing existing trusted locations associated with the users;
• for each identified location used by a user, determining whether the identified location matches one of the existing trusted locations for the user in the trusted location registry;
• in response to the determining that the identified location matches the existing trusted locations for the user in the trusted location registry, designating the identified location as a trusted location;
• in response to the determining that the identified location does not match the existing trusted locations for the user in the trusted location registry, determining whether the identified location matches one of known locations associated with the enterprise, the user, or peers of the user associated with the enterprise;
• in response to the determining that the identified location matches the known locations, designating the identified location as a trusted location and adding the identified location to the trusted location registry as an existing trusted location for the user;
• in response to the determining that the identified location does not matched the known locations, evaluating the identified location using one or more trusted location criteria to designate the identified location as a trusted location or a non-trusted location;
• in response to the evaluating that the identified location is a trusted location, designating the identified location as a trusted location and adding the identified location to the trusted location registry as an existing trusted location for the user;
• and
• in response to the evaluating that the identified location is not a trusted location, designating the identified location as a non-trusted location.