Abstract: First information associated with a first user login activity is received, as is second information associated with a second user login activity. A determination is made, using the received first and second information, that the first user login activity and second user login activity have a parent-child relationship. The first user login activity and the second user login activity are linked to at least one user and a process.

Abstract: Log data associated with at least one user session in a network environment associated with an original user is received. A logical graph is generated using at least a portion of the received log data. One example of such a logical graph is a privilege change graph that models privilege changes between processes. Another example of such a logical graph is a user login graph that models machines with which the original user interacts. Another example of such a logical graph is a machine-server graph that clusters machines into nodes based on resources executing on the machine. The generated logical graph is used to detect an anomaly.

Abstract: Log data associated with an environment that includes containers is received. An example of such an environment is one managed by Kubernetes. A logical graph is generated using at least a portion of the received log data. The logical graph is used to detect an anomaly. In response to the anomaly being detected, the anomaly is recorded.

Abstract: Network activity data is received, for example, from a set of agents reporting collectively information about a set of hosts. The received network activity data is used to identify a user login activity. A logical graph that links the user login activity to at least one user and at least one process is generated.

Abstract: Log data associated with at least one user session associated with an original user is received. A logical graph is generated using at least a portion of the received log data. One example of such a logical graph is a privilege change graph that models privilege changes between processes. Another example of such a logical graph is a user login graph that models machines with which the original user interacts. Another example of such a logical graph is a machine-server graph that clusters machines into nodes based on resources executing on the machine. The generated logical graph is used to detect an anomaly. The detected anomaly is recorded.