Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection
Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.
Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.
- Analyzed 40,000+ identities across 125 cloud environments over two months
- UMAP and HDBSCAN clustering maps identities to functional roles like admin and DevOps
- Lightweight heuristics extractable into standard SQL for scalable detection
- Naming conventions and IAM policies often hide an identity's true behavior
- Methodology applies beyond AWS CloudTrail to other cloud, SaaS and Kubernetes logs
From the original article
12 min read at unit42.paloaltonetworks.com
We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42.
By Osher Jacob · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.