Event-driven collection and monitoring of resources in a cloud computing environment

Patent metadata

Field	Value
Publication number	US-12563083-B2
Application number	US-202318488764-A
Country	US
Kind code	B2
Filing date	Oct 17, 2023
Priority date	Nov 9, 2022
Publication date	Feb 24, 2026
Grant date	Feb 24, 2026

Abstract

Techniques for event driven harvesting and analysis of cloud computing resources in a cloud computing environment, comprising: obtaining information about at least one cloud computing event in the cloud computing environment; determining if the at least one event is related to the allocation of storage to a cloud computing resource; in response to determining the at least one event is related to the allocation of storage to a cloud computing resource, requesting data from the cloud computing resource; and analyzing the data for the presence of security risks and vulnerabilities.

First claim

What is claimed is:

1 . A method for event-driven monitoring of resources in a cloud computing environment, the method comprising:
using at least one computer hardware processor to perform:
obtaining, from the cloud computing environment, information about at least one cloud computing event;
determining, using the information obtained from the cloud computing environment, whether the at least one cloud computing event is associated with allocation of storage for a virtual cloud computing resource;
in response to determining that the at least one cloud computing event is associated with the allocation of the storage for the virtual cloud computing resource, requesting data from the storage allocated to the virtual cloud computing resource; and
analyzing the data to detect presence of one or more security risks.

2 . The method of claim 1 ,
wherein the at least one cloud computing event comprises a first cloud computing event, and wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises obtaining information about features including a time at which the first cloud computing event occurred, an event type for the first cloud computing event, one or more unique event identifiers for the first cloud computing event, storage associated with the first cloud computing event, and a virtual cloud computing resource associated with the first cloud computing event.

3 . The method of claim 1 ,
wherein requesting the data from the storage allocated to the virtual cloud computing resource is performed in response to determining that a first cloud computing event is associated with allocation of storage for a virtual cloud computing service, and wherein the first cloud computing event is associating the storage with the virtual cloud computing resource.

4 . The method of claim 3 ,
wherein the cloud computing environment is an Amazon Web Services cloud computing environment, and wherein the first cloud computing event is an Attach Volume event.

5 . The method of claim 1 ,
wherein requesting the data from the storage allocated to the virtual cloud computing resource is performed in response to determining that two cloud computing events are associated with allocation of storage for a virtual cloud computing service, wherein the two cloud computing events are:
allocating storage in the cloud computing environment, and
associating the allocated storage with the virtual cloud computing resource.

6 . The method of claim 5 ,
wherein the cloud computing environment is an Amazon Web Services cloud computing environment, wherein the two cloud computing events are a Create Volume event and an Attach Volume event.

7 . The method of claim 1 , wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises:
accessing a log of cloud computing events within the cloud computing environment; and obtaining information about the at least one cloud computing event from the log.

8 . The method of claim 1 , wherein requesting the data from the storage allocated to the virtual cloud computing resource comprises taking a snapshot of the storage allocated to the virtual cloud computing resource.

9 . The method of claim 1 , further comprising:
when it is detected that the one or more security risks are present within the data, recommending one or more respective corrective actions to address the one or more security risks, wherein the respective corrective actions comprise at least one of: updating software installed in the virtual cloud computing resource, changing a network configuration of the virtual cloud computing resource, changing a configuration of one or more software applications executing on the virtual cloud computing resource, changing a configuration of an operating system executing on the virtual cloud computing resource, changing one or more permissions for the virtual cloud computing resource, deleting malware from the virtual cloud computing resource, removing corrupted files or data from the virtual cloud computing resource, taking the virtual cloud computing resource offline, killing an instance of the virtual cloud computing resource, and/or blocking communications to and/or from the virtual cloud computing resource.

10 . The method of claim 1 , wherein analyzing the data to detect presence of one or more security risks comprises identifying the presence of one or more software bugs, one or more out-of-date software applications, one or more unpatched software applications, corrupted data, unencrypted data, one or more improper access permissions for resources, one or more misconfigurations, one or more computer viruses, and/or malware within the data.

11 . The method of claim 1 , wherein the at least one cloud computing event comprises a first event, wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises:
obtaining, from the cloud computing environment, first data related to the first event that occurred in the cloud computing environment, the first event relating to a first resource in the cloud computing environment, the first data including a first identifier for the first event; and in response to obtaining the first data, requesting, from an application programming interface (API) of the cloud computing environment and using the first identifier, supplemental data about the first event, the supplemental data including supplemental information about the first event and/or information about impact of the first event on the first resource.

12 . The method of claim 11 , wherein information about the impact of the first event on the first resource comprises information about changes to an amount of storage associated with the first resource and information about changes to metadata associated with the first resource, and wherein information about changes to metadata associated with the first resource comprises information about changes to a structure of data within the first resource, changes to software installed on the first resource, changes to permissions for accessing the first resource, and/or changes to security rules relating to the first resource.

13 . A system for event-driven monitoring of resources in a cloud computing environment, the system comprising:
at least one computer hardware processor; and at least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by the at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising:
obtaining, from the cloud computing environment, information about at least one cloud computing event;
determining, using the information obtained from the cloud computing environment, whether the at least one cloud computing event is associated with allocation of storage for a virtual cloud computing resource;
in response to determining that the at least one cloud computing event is associated with the allocation of the storage for the virtual cloud computing resource, requesting data from the storage allocated to the virtual cloud computing resource; and
analyzing the data to detect presence of one or more security risks.

14 . The system of claim 13 ,
wherein the at least one cloud computing event comprises a first cloud computing event, and wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises obtaining information about features including a time at which the first cloud

Assignees

• Rapid7 Inc

Inventors

• Martin Dylan
• Lee Austin
• Mckee Trever Allen
• Green James Andrew
• Deramus Chris

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L47/82 Primary

  Miscellaneous aspects · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title