Abstract: An improved computing tool performs an improved computing tool function to identify sensitive data risks in cloud-based deployments. A knowledge graph is built based on data schema information for a cloud-based computing environment, a set of parsed infrastructure logs, and a set of captured application queries. A set of sensitive flows in the knowledge graph are identified representing paths from a sensitive data element to an endpoint in the knowledge graph. The set of sensitive flows are scored based on a scoring algorithm and an alert is issued to an administrator in response to a score of a sensitive flow within the set of sensitive flows exceeding a threshold.

Abstract: Data access requests are grouped into a plurality of clusters according to an activity count within each of a plurality of time periods. Based on a time separating two clusters in the plurality of clusters, a time window in which a data access policy applies is defined. Using the plurality of data access requests, a forecasting model is trained to predict a volume of future data access requests, the training resulting in a trained forecasting model. A data access policy effective during the time window and conditioned on a threshold related to the volume of future data access requests is generated. Responsive to determining that a new data request meets a criterion of the data access policy, processing of the new data request is allowed.

Abstract: Described are techniques for coalescing duplicative representations of entities in knowledge graphs. The techniques include unifying a first representation of a first entity with a second representation of the first entity in a knowledge graph of a cloud environment based on the first representation and the second representation sharing a predefined configuration of attributes. The techniques further include unifying a third representation of a second entity with a fourth representation of the second entity in the knowledge graph based on a temporal activity signature of the third representation being matched to the fourth representation by a Long-Short Term Memory (LSTM) network model. The techniques further include outputting the knowledge graph with a first unified representation of the first entity based on the first representation and the second representation and a second unified representation of the second entity based on the third representation and the fourth representation.

Abstract: An improved computing tool performs an improved computing tool function to identify sensitive data risks in cloud-based deployments. A knowledge graph is built based on data schema information for a cloud-based computing environment, a set of parsed infrastructure logs, and a set of captured application queries. A set of sensitive flows in the knowledge graph are identified representing paths from a sensitive data element to an endpoint in the knowledge graph. The set of sensitive flows are scored based on a scoring algorithm and an alert is issued to an administrator in response to a score of a sensitive flow within the set of sensitive flows exceeding a threshold.

Abstract: Mechanisms are provided in a cloud-based computing environment for identifying sensitive data risks in cloud-based deployments. The mechanisms build a knowledge graph based on data schema information for a cloud-based computing environment, a set of parsed infrastructure logs, and a set of captured application queries. The mechanisms identify a set of sensitive flows in the knowledge graph representing paths from a sensitive data element to an endpoint in the knowledge graph. The mechanisms score the set of sensitive flows based on a scoring algorithm and issue an alert to an administrator in response to a score of a sensitive flow within the set of sensitive flows exceeding a threshold.

Abstract: Mechanisms are provided in a cloud-based computing environment for identifying sensitive data risks in cloud-based deployments. The mechanisms build a knowledge graph based on data schema information for a cloud-based computing environment, a set of parsed infrastructure logs, and a set of captured application queries. The mechanisms identify a set of sensitive flows in the knowledge graph representing paths from a sensitive data element to an endpoint in the knowledge graph. The mechanisms score the set of sensitive flows based on a scoring algorithm and issue an alert to an administrator in response to a score of a sensitive flow within the set of sensitive flows exceeding a threshold.

Abstract: In response to determining that an event matches a condition of a rule, a given one of a plurality of computing nodes is selected to send the event, based on one or both of an attribute of the event and an identifier of the rule. Information of the event is sent to the given computing node to perform correlation of the event with another event.

Abstract: In response to determining that an event matches a condition of a rule, a given one of a plurality of computing nodes is selected to send the event, based on one or both of an attribute of the event and an identifier of the rule. Information of the event is sent to the given computing node to perform correlation of the event with another event.