Abstract: An improved computing tool performs an improved computing tool function to identify sensitive data risks in cloud-based deployments. A knowledge graph is built based on data schema information for a cloud-based computing environment, a set of parsed infrastructure logs, and a set of captured application queries. A set of sensitive flows in the knowledge graph are identified representing paths from a sensitive data element to an endpoint in the knowledge graph. The set of sensitive flows are scored based on a scoring algorithm and an alert is issued to an administrator in response to a score of a sensitive flow within the set of sensitive flows exceeding a threshold.

Abstract: Mechanisms are provided in a cloud-based computing environment for identifying sensitive data risks in cloud-based deployments. The mechanisms build a knowledge graph based on data schema information for a cloud-based computing environment, a set of parsed infrastructure logs, and a set of captured application queries. The mechanisms identify a set of sensitive flows in the knowledge graph representing paths from a sensitive data element to an endpoint in the knowledge graph. The mechanisms score the set of sensitive flows based on a scoring algorithm and issue an alert to an administrator in response to a score of a sensitive flow within the set of sensitive flows exceeding a threshold.

Abstract: Mechanisms are provided in a cloud-based computing environment for identifying sensitive data risks in cloud-based deployments. The mechanisms build a knowledge graph based on data schema information for a cloud-based computing environment, a set of parsed infrastructure logs, and a set of captured application queries. The mechanisms identify a set of sensitive flows in the knowledge graph representing paths from a sensitive data element to an endpoint in the knowledge graph. The mechanisms score the set of sensitive flows based on a scoring algorithm and issue an alert to an administrator in response to a score of a sensitive flow within the set of sensitive flows exceeding a threshold.

Abstract: In response to determining that an event matches a condition of a rule, a given one of a plurality of computing nodes is selected to send the event, based on one or both of an attribute of the event and an identifier of the rule. Information of the event is sent to the given computing node to perform correlation of the event with another event.

Abstract: In response to determining that an event matches a condition of a rule, a given one of a plurality of computing nodes is selected to send the event, based on one or both of an attribute of the event and an identifier of the rule. Information of the event is sent to the given computing node to perform correlation of the event with another event.