Intrusion detection system enrichment based on system lifecycle

Abstract

Techniques are described for automatically incorporating lifecycle information for a secured environment (SE) into an intrusion detection system monitoring the secured environment's operations. In one example, a secured environment including at least one component is monitored, where the secured environment is associated with a lifecycle operations manager (LOM) responsible for managing lifecycle operations associated with at least one component in the SE. One or more log files associated with operations of each of the at least one components are obtained, along with log files associated with lifecycle operations executed by the LOM. A determination is made as to whether the particular activities documented in the log files indicate a violation of at least one malicious action rule. In response to determining that the log files are associated with a malicious action rule, a mitigation action associated with the violation is triggered.