AnalysisPublished 14 Sep 2026

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Source Palo Alto Unit 42

cloud

Description

This analysis discusses a behavioral clustering model designed to map cloud identity roles from audit logs, enabling continuous threat detection through standard SQL queries. The model uses unsupervised machine learning techniques to categorize cloud identities based on their activity patterns, improving visibility into cloud environments and aiding detection of malicious behavior masked by legitimate permissions or labels. The research focuses on AWS CloudTrail data but is extendable to other cloud and SaaS environments. It highlights the challenge of distinguishing between what identities can do (permissions) and what they actually do (behavior), emphasizing the importance of behavioral context in cloud security detection.

Impact

The model enhances cloud security by providing richer context for detecting malicious activity that might otherwise be hidden by legitimate permissions or benign labels. It helps differentiate normal operational behavior from potential security breaches by mapping identities to their functional roles based on actual behavior rather than assigned permissions alone. This improves detection accuracy and reduces false positives in cloud threat detection. There is no indication of a direct vulnerability or exploit; rather, this is a research and detection enhancement.

Defensive guidance

This is a research and detection methodology rather than a vulnerability requiring patching. Organizations can adopt the behavioral clustering approach to improve cloud identity visibility and threat detection. Palo Alto Networks customers benefit from integrated protections via Cortex Cloud, Cortex XDR, XSIAM, and Idira products. No direct remediation or patch is applicable. Organizations should consider implementing similar behavioral analysis techniques to complement existing cloud security posture management and identity governance.

Summary

The research presents a behavioral clustering model that analyzes cloud audit logs to map functional roles of cloud identities, such as administrators, backup services, security tools, and DevOps. Using unsupervised machine learning algorithms UMAP and HDBSCAN, the model clusters over 40,000 identities from 125 cloud environments based on their API activity patterns. This approach overcomes limitations of relying solely on IAM policies or naming conventions, which can be misleading due to over-privileged identities and attacker masquerading. The model enables continuous operational visibility and automated threat detection via lightweight heuristics implemented in SQL, demonstrated with a focus on AWS CloudTrail data. The methodology is adaptable to other cloud providers and environments.

References

unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Sep 2026, 10:09 UTC

References

Community reviews

Related threats