A system for security of cloud resources, the system comprising: a memory device including profiles (718, 720, 722) thereon, each profile of the profiles detailing non-anomalous behavior of a client interaction with a cloud resource of the cloud resources, wherein each profile is associated with a granularity level and each profile (718, 720) at a higher granularity level than a lowest granularity level is associated with a lower granularity profile (720, 722), the lower granularity profile associated with a different cloud resource of the cloud resources that must be accessed to perform an operation on the cloud resource; processing circuitry coupled to the memory, the processing circuitry to perform operations comprising: identifying the profile of the profiles associated with event data, the event data regarding an operation performed on the cloud resource and including data identifying the cloud resource of the cloud resources that is a destination of the operation and the client that is a source of the operation; determining whether the event data is associated with anomalous customer interaction with the cloud resource; in response to determining the event data is associated with anomalous customer interaction, identifying whether another cloud resource of the cloud resources with a lower granularity profile that is associated with the profile of the cloud resource has previously been determined to be a target of an anomalous operation; and providing a single alert to a client device indicating the anomalous customer interaction with the cloud resource in response to determining both (a) the event data is associated with the anomalous customer interaction with the cloud resource and (b) it was previously determined that the another cloud resource is determined to be the target of the anomalous operation. a memory device including profiles (718, 720, 722) thereon, each profile of the profiles detailing non-anomalous behavior of a client interaction with a cloud resource of the cloud resources, wherein each profile is associated with a granularity level and each profile (718, 720) at a higher granularity level than a lowest granularity level is associated with a lower granularity profile (720, 722), the lower granularity profile associated with a different cloud resource of the cloud resources that must be accessed to perform an operation on the cloud resource; processing circuitry coupled to the memory, the processing circuitry to perform operations comprising: identifying the profile of the profiles associated with event data, the event data regarding an operation performed on the cloud resource and including data identifying the cloud resource of the cloud resources that is a destination of the operation and the client that is a source of the operation; determining whether the event data is associated with anomalous customer interaction with the cloud resource; in response to determining the event data is associated with anomalous customer interaction, identifying whether another cloud resource of the cloud resources with a lower granularity profile that is associated with the profile of the cloud resource has previously been determined to be a target of an anomalous operation; and providing a single alert to a client device indicating the anomalous customer interaction with the cloud resource in response to determining both (a) the event data is associated with the anomalous customer interaction with the cloud resource and (b) it was previously determined that the another cloud resource is determined to be the target of the anomalous operation. identifying the profile of the profiles associated with event data, the event data regarding an operation performed on the cloud resource and including data identifying the cloud resource of the cloud resources that is a destination of the operation and the client that is a source of the operation; determining whether the event data is associated with anomalous customer interaction with the cloud resource; in response to determining the event data is associated with anomalous customer interaction, identifying whether another cloud resource of the cloud resources with a lower granularity profile that is associated with the profile of the cloud resource has previously been determined to be a target of an anomalous operation; and providing a single alert to a client device indicating the anomalous customer interaction with the cloud resource in response to determining both (a) the event data is associated with the anomalous customer interaction with the cloud resource and (b) it was previously determined that the another cloud resource is determined to be the target of the anomalous operation.