Patent ID: 11886610
Assignee: NORMALYZE, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 15:
16. A computer-implemented method of detecting security posture of a cloud environment, the computer-implemented method comprising:
automatically discovering a plurality of databases, in response to a triggering criterion in the cloud environment, by accessing a cloud application programming interface (API) exposed by the cloud environment and executing a query through the cloud API that returns database identifiers that identify the plurality of databases that have logging enabled;
receiving a request to analyze a particular database, from among the plurality of databases, in the cloud environment;
parsing, using a loci analyzer microservice from among a plurality of microservices that were deployed by an orchestration engine on the plurality of databases, a database query log corresponding to the particular database to obtain a parser result, wherein the database query log includes a set of log entries representing database queries on the particular database, and each log entry of the set of log entries identifies a requestor and a target dataset on the particular database;
based on parsing the database query log, identifying one or more query instance that match a pre-defined risk signature;
generating an analysis result by the log analyzer microservice representing the one or more query instance that match the pre-defined risk signature; and
generating an output representing the analysis results.