Identifying sensitive data writes to data stores

Abstract

Techniques for detecting access to data classified as sensitive by plugin running on a computer system are described herein. A data event is generated that includes information about the access to the data classified as sensitive as a result of detecting the access to the data. The data event is then transmitted to a logging service over a network.

1 - 20 . (canceled) 
     
     
         21 . A computer-implemented method, comprising:
 detecting, by a plugin running on a computer system, access by the computer system to data classified as sensitive;   as a result of detecting the access, generating a data event that includes information about the access to the data classified as sensitive; and   transmitting, over a network, the data event to a logging service.   
     
     
         22 . The computer-implemented method of  claim 21 , further comprising:
 receiving a query to determine if the plugin is installed; and   providing a response to the query that indicates the plugin is installed.   
     
     
         23 . The computer-implemented method of  claim 21 , further comprising:
 providing an indication that the plugin is not installed; and   in response to the indication, receiving a communication to cause installation of the plugin.   
     
     
         24 . The computer-implemented method of  claim 21 , further comprising:
 providing an indication that the plugin is not running; and   in response to the indication, receiving a communication to cause the plugin to be started.   
     
     
         25 . The computer-implemented method of  claim 21 , wherein transmitting of the data event to the logging service includes logging a date and time of the access, types of the sensitive data, and size of the sensitive data. 
     
     
         26 . The computer-implemented method of  claim 21 , wherein transmitting the data event to the logging service further includes logging the data event to a log. 
     
     
         27 . A system, comprising:
 one or more hardware processors; and   memory that includes instructions that, if executed by the one or more hardware processors, cause the system to:   detect access to sensitive data by a plugin running on the system;   in response to the detection of the access, generate one or more data events that include information about the access to the sensitive data; and   send the one or more data events to a logging service.   
     
     
         28 . The system of  claim 27 , wherein the instructions further cause the system to:
 receive a query to determine if the plugin is installed; and   as a result of the plugin being installed, provide a response to the query.   
     
     
         29 . The system of  claim 28 , wherein the instructions that cause the system to generate the one or more data events, if executed by the one or more hardware processors, cause the system to provide characteristics of the access with the one or more data events. 
     
     
         30 . The system of  claim 27 , wherein the instructions further cause the system to:
 record, by the plugin running on the system, the data event; and   send the data event to a policy service.   
     
     
         31 . The system of  claim 27 , wherein the instructions are code of the plugin. 
     
     
         32 . The system of  claim 27 , wherein the one or more data events indicate a type of the sensitive data. 
     
     
         33 . The system of  claim 32 , wherein the one or more data events record metadata about the access. 
     
     
         34 . A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
 detect access by a plugin on the computer system to sensitive data;   generate a data event that includes information about the access to the sensitive data; and   perform an operation to cause a logging service to receive the data event from the plugin, the operation being performed over a network.   
     
     
         35 . The non-transitory computer-readable storage medium of  claim 34 , wherein the executable instructions further cause the computer system to:
 record the data event; and   transmit the data event to a policy service.   
     
     
         36 . The system of  claim 35 , wherein the plugin provides the data event with data events from a backend service for a comparison to verify if the plugin is installed correctly. 
     
     
         37 . The system of  claim 36 , wherein the comparison to verify if the plugin being installed correctly is performed by a log analysis service. 
     
     
         38 . The system of  claim 34 , wherein the executable instructions further cause the computer system to:
 receiving a query to determine if the plugin is installed or running; and   providing a response to the query that indicates whether the plugin is installed or running.   
     
     
         39 . The system of  claim 34 , wherein the plugin logs the data event to one or more logs including writes to a local disk. 
     
     
         40 . The system of  claim 34 , the executable instructions further cause the computer system to:
 detect a client for an introduction of the sensitive data; and   as a result of the detection, issue the data event to the policy service.