Unit 42 details behavioral clustering of AWS CloudTrail logs to map cloud identity roles and detect masquerading
Unit 42 (Palo Alto Networks) published research on a behavioral clustering model that maps cloud identities to functional roles from audit log activity. The model covered more than 40,000 identities across 125 cloud environments over two months. It groups identities such as administrators, backup services, security tooling and DevOps by t…