Abstract: A system and method for improving CDR from a plurality of CSPs is presented. The method includes receiving a first event a first CSP and a second event from a second CSP; generating a first normalized event based on data extracted from the first event and a predefined data schema; generating a second normalized event based on data extracted from the second event and the predefined data schema; storing the first normalized event and the second normalized event in a normalized log; detecting a cybersecurity threat based on an event of the normalized log; extracting from the event an identifier of a cloud entity; querying a security database to detect a representation the cloud entity; determining that the detected representation is associated with a cybersecurity risk; and initiating an active response in a cloud computing environment associated with the cloud entity, based on the cybersecurity risk and the detected threat.

Abstract: A system and method for improving CDR by generating a normalized event log from a plurality of cloud computing layers is presented. The method includes receiving a plurality of events, wherein a first event is generated from a first cloud layer of a cloud computing environment provided by a cloud service provider (CSP) and a second event is generated from a second cloud layer of the cloud computing environment, and wherein each event includes a data record; generating a first normalized event based on data extracted from the first event; generating a second normalized event based on data extracted from the second event; applying a rule on the first normalized event and the second normalized event; detecting a cybersecurity threat based on a result of applying the rule; and initiating an active response in the cloud computing environment based on the detected cybersecurity threat.

Abstract: A system and method improves cloud detection and response by generating a normalized event log from a plurality of cloud service providers (CSPs). The method includes receiving a plurality of events, wherein a first event of the plurality of events is generated in a cloud computing environment provided by a first CSP and a second event of the plurality of events is generated in a cloud computing environment provided by a second CSP; extracting data from an event of the plurality of events; generating a normalized event based on the extracted data and a predefined data schema, the predefined data schema including a plurality of data fields; storing the normalized event in a transactional database having stored therein a normalized event log; and applying a rule from a rule engine on a normalized event stored in the transactional database to detect a cybersecurity threat in any of the CSPs.

Abstract: A system and method improves cloud detection and response by generating a normalized event log from a plurality of cloud computing layers. The method includes receiving a plurality of events, wherein a first event is generated in a first cloud layer of a cloud computing environment provided by a cloud service provider (CSP) and a second event is generated in a second cloud layer of the cloud computing environment; extracting data from each event; generating a normalized event based on the extracted data and further based on a predefined data schema, the predefined schema including a plurality of data fields, at least a portion of which are related to cloud layers; storing the normalized event in a transactional database having stored therein a normalized event log; and applying a rule from a rule engine on the normalized event to detect a cybersecurity threat in the cloud computing environment.

Abstract: A system and method improves cloud detection and response by generating a normalized event log from a plurality of cloud service providers (CSPs). The method includes receiving a plurality of events, wherein a first event of the plurality of events is generated in a cloud computing environment provided by a first CSP and a second event of the plurality of events is generated in a cloud computing environment provided by a second CSP; extracting data from an event of the plurality of events; generating a normalized event based on the extracted data and a predefined data schema, the predefined data schema including a plurality of data fields; storing the normalized event in a transactional database having stored therein a normalized event log; and applying a rule from a rule engine on a normalized event stored in the transactional database to detect a cybersecurity threat in any of the CSPs.

Abstract: A system and method improves cloud detection and response by generating a normalized event log from a plurality of cloud computing layers. The method includes receiving a plurality of events, wherein a first event is generated in a first cloud layer of a cloud computing environment provided by a cloud service provider (CSP) and a second event is generated in a second cloud layer of the cloud computing environment; extracting data from each event; generating a normalized event based on the extracted data and further based on a predefined data schema, the predefined schema including a plurality of data fields, at least a portion of which are related to cloud layers; storing the normalized event in a transactional database having stored therein a normalized event log; and applying a rule from a rule engine on the normalized event to detect a cybersecurity threat in the cloud computing environment.