US 12,225,037 B1
Techniques for cybersecurity investigation of cloud entity misuse leveraging runtime context
Ami Luttwak, Binyamina (IL); Alon Schindel, Tel Aviv (IL); Shir Tamari, Tel Aviv (IL); and Ron Cohen, Tel Aviv (IL)
Assigned to Wiz, Inc., New York, NY (US)
Filed by Wiz, Inc., New York, NY (US)
Filed on Mar. 29, 2024, as Appl. No. 18/621,304.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 63/1416 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method for associating an event in a cloud computing log to a process running on a workload, comprising:
configuring a workload deployed in a cloud computing environment to deploy thereon a sensor, the sensor configured to detect a runtime process on the workload, the runtime process utilizing an identity;
detecting in a log of the cloud computing environment an event based on an identifier of the workload, the log including a plurality of events;
inspecting a code object for a cybersecurity object, the code object utilized in deploying the workload in the cloud computing environment;
associating the runtime process with the event based on an identifier of the workload and the cybersecurity object, wherein the cybersecurity object indicates the identity; and
generating an enriched log including an identifier of the runtime process associated with the event and the cybersecurity object.