Identification of a resource attack path by connecting code, configuration, and telemetry

Abstract

Computing resources deployed on the cloud can be susceptible to different types of malicious attacks based on vulnerabilities introduced in computer program instructions that define the computing resources. To address these types of attacks, methods, systems, apparatuses, and computer-readable storage mediums are described for identifying a resource attack path. A vulnerability identifier scans a set of computer program instructions to identify a vulnerability therein. A resource mapper generates a resource map that identifies a relationship between a portion of the set of computer program instructions and a resource executing in a cloud. An attack path identifier obtains a log that identifies telemetry events in the cloud. The attack path identifier further identifies an attack path based at least on the identified vulnerability, the resource map, and the log. A security event remediator performs a remediation action in response to the identifying the attack path.