Cortex Cloud

Unit 42 sorted 40,000 cloud identities into job roles using two months of CloudTrail

Two months of AWS audit logs from 125 environments went through UMAP and HDBSCAN to group more than 40,000 identities by what they actually did, and the classification rules that fell out run in plain SQL.