Systems and interactive user interfaces for dynamic retrieval, analysis, and triage of data items

• US 10,552,994 B2
• Filed: 09/21/2015
• Issued: 02/04/2020
• Est. Priority Date: 12/22/2014
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Yousaf, Timothy, Dennison, Drew, Thoren, Paul, Pham, Khoa, Ball, Eliot, Tank, Spencer, McRaven, John, Ray, Lucas, Tsui, Jeffrey
• Primary Examiner(s): Vu, Kieu D
• Assistant Examiner(s): Basom, Blaine T.
• Application Number:
  US14/859,882
• Publication Number:
  US 20160180557A1
• Time in Patent Office: 1,597 Days
• CPC Class Codes: G06F 16/3328 using graphical result space presentation or visualisation
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/338 Presentation of query results
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs

Abstract

Embodiments of the present disclosure relate to a data analysis system that may receive data comprising a plurality of raw data items from one or more data sources, such as a monitoring agent located in a monitored network. The received data may be scored using one or more scoring rules and/or algorithms, with raw data items satisfying a score threshold designated as “data item leads.” Raw data items associated with a data item lead may be searched and displayed to the user via an interactive user interface. The data analysis system may be used to execute searches and additional enrichments against the received raw data items. The data analysis system may group received raw data items based upon shared attribute values. The data analysis system may be used to categorize received data and construct timelines, histograms, and/or other visualizations based upon the various attributes of the raw data items.

Claims

1. A computer system configured generate an interactive graphical user interface for accessing, enriching, and analyzing a plurality of raw data items, the computer system comprising:

one or more computer readable storage devices configured to store;

a plurality of computer executable instructions; and

a plurality of raw data items, wherein a raw data item is associated with one or more attributes, wherein the one or more attributes comprise at least one time-based attribute; and

one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the plurality of computer executable instructions in order to cause the computer system to;

identify a data item lead from the plurality of raw data items;

receive one or more search parameters based at least in part upon an attribute associated with the data item lead;

query the plurality of raw data items based at least in part upon the received search parameters to receive a first group of raw data items; and

generate an interactive graphical user interface to display the first group of raw data items, wherein the interactive graphical user interface comprises;

a plurality of tabs that are each associated with respective subsets of the first group of raw data items, wherein one of the plurality of tabs comprises a currently displayed tab;

a table that includes, in a tabular format, at least a portion of the first group of raw data items associated with the currently displayed tab;

a histogram of at least a portion of the first group of raw data items, wherein raw data items included in the histogram are grouped based at least in part upon shared attribute values of the raw data items, and wherein the raw data items included in the histogram are associated with the currently displayed tab; and

a timeline of at least a portion the first group of raw data items, wherein raw data items included in the timeline are grouped based at least in part upon a time-based attribute of the raw data items, and wherein the raw data items included in the timeline are associated with at least two of the plurality of tabs;

receive, via the interactive graphical user interface, a user selection of at least one shared attribute value associated with the histogram or at least one time-based attribute value associated with the timeline, wherein the user selection indicates a selection of one or more graphical elements representing one or more raw data items displayed in the histogram or timeline; and

in response to the receiving the user selection, update the table, histogram, and timeline such that the table, histogram, and timeline include only raw data items of the first group of raw data items corresponding with the selected at least one shared attribute value or the selected at least one time-based attribute value.

2. The computer system of claim 1, wherein a raw data item corresponds to an occurrence of a proxy request on a monitored network.

3. The computer system of claim 1, wherein a raw data item corresponds to an occurrence of a process on a device on a monitored network.

4. The computer system of claim 1, wherein identifying a data item lead comprises:

receiving the plurality of raw data items from one or more data sources;

performing initial analysis or filtering on the plurality of raw data items;

performing at least one enrichment on the plurality of raw data items;

calculating scores for the plurality raw data items; and

identifying a raw data item of the plurality of raw data items having a score satisfying a threshold as a data item lead.

5. The computer system of claim 4, wherein performing initial analysis or filtering on the plurality of raw data items comprises running the plurality of raw data items against a whitelist.

6. The computer system of claim 4, wherein performing at least one enrichment on the plurality of data items comprises performing an external analysis on the plurality of raw data items using one or more third party analysis systems.

7. The computer system of claim 4, wherein performing at least one enrichment on the plurality of data items comprises determining a frequency or distribution of an event associated with a raw data item of the plurality of raw data items.

8. The computer system of claim 1, wherein the plurality of computer executable instructions are configured to further cause the computer system to perform an aggregation of raw data items of the first group of raw data items based at least in part upon an attribute value.

9. The computer system of claim 1, wherein the first group of raw data items comprises raw data items of two or more data types.

10. The computer system of claim 9, wherein the raw data items are separated into two or more tabs of the plurality of tabs based upon a type of the raw data items.

11. The computer system of claim 1, wherein the selected attribute is associated with one or more attribute value groups, and wherein the histogram groups data items of the first group of raw data items using the one or more attribute value groups.

12. The computer system of claim 1, wherein the selected attribute is selected from the one or more attributes based at least in part upon a selection by a human analyst.

13. The computer system of claim 1, wherein the time-based attribute of the at least one time-based attribute is selected based at least in part upon a selection by a human analyst.

14. The computer system of claim 1, wherein the raw data items included in the timeline includes the raw data items that are associated with a currently displayed tab.

15. The computer system of claim 1, wherein the raw data items displayed by the timeline comprises raw data items associated with all tabs of the two or more tabs.

16. A computer-implemented method of generating an interactive graphical user interface for accessing, enriching, and analyzing a plurality of raw data items, the computer-implemented method comprising:

by one or more hardware computer processors configured to execute computer executable instructions;

identifying a data item lead from a plurality of raw data items, wherein a raw data item is associated with one or more attributes, wherein the one or more attributes comprise at least one time-based attribute;

receiving one or more search parameters based at least in part upon an attribute associated with the data item lead;

querying the plurality of raw data items based at least in part upon the received search parameters to receive a first group of raw data items; and

generating an interactive graphical user interface to display the first group of raw data items, wherein the interactive graphical user interface comprises;

a plurality of tabs that are each associated with respective subsets of the first group of raw data items, wherein one of the plurality of tabs comprises a currently displayed tab;

a table that includes, in a tabular format, at least a portion of the first group of raw data items associated with the currently displayed tab;

a histogram of at least a portion of the first group of raw data items, wherein raw data items included in the histogram are grouped based at least in part upon shared attribute values of the raw data items, and wherein the raw data items included in the histogram are associated with the currently displayed tab; and

a timeline of at least a portion the first group of raw data items, wherein raw data items included in the timeline are grouped based at least in part upon a time-based attribute of the raw data items, and wherein the raw data items included in the timeline are associated with at least two of the plurality of tabs;

receiving, via the interactive graphical user interface, a user selection of at least one shared attribute value associated with the histogram or at least one time-based attribute value associated with the timeline, wherein the user selection indicates a selection of one or more graphical elements representing one or more raw data items displayed in the histogram or timeline; and

in response to the receiving the user selection, updating the table, histogram, and timeline such that the table, histogram, and timeline include only raw data items of the first group of raw data items corresponding with the selected at least one shared attribute value or the selected at least one time-based attribute value.

17. The computer-implemented method of claim 16, wherein the raw data items included in the timeline are associated with all tabs of the plurality of tabs.

18. The computer-implemented method of claim 16 wherein the raw data items included in the timeline includes the raw data items that are associated with a currently displayed tab.

19. A non-transitory computer-readable storage medium including computer executable instructions that, when executed by a processor, cause the processor to:

identify a data item lead from a plurality of raw data items, wherein a raw data item is associated with one or more attributes, wherein the one or more attributes comprise at least one time-based attribute;

receive one or more search parameters based at least in part upon an attribute associated with the data item lead;

query the plurality of raw data items based at least in part upon the received search parameters to receive a first group of raw data items; and

generate an interactive graphical user interface to display the first group of raw data items, wherein the interactive graphical user interface comprises;

a plurality of tabs that are each associated with respective subsets of the first group of raw data items, wherein one of the plurality of tabs comprises a currently displayed tab;

a table that includes, in a tabular format, at least a portion of the first group of raw data items associated with the currently displayed tab;

a histogram of at least a portion of the first group of raw data items, wherein raw data items included in the histogram are grouped based at least in part upon shared attribute values of the raw data items, and wherein the raw data items included in the histogram are associated with the currently displayed tab; and

a timeline of at least a portion the first group of raw data items, wherein raw data items included in the timeline are grouped based at least in part upon a time-based attribute of the raw data items, and wherein the raw data items included in the timeline are associated with at least two of the plurality of tabs;

receive, via the interactive graphical user interface, a user selection of at least one shared attribute value associated with the histogram or at least one time-based attribute value associated with the timeline, wherein the user selection indicates a selection of one or more graphical elements representing one or more raw data items displayed in the histogram or timeline; and

in response to the receiving the user selection, update the table, histogram, and timeline such that the table, histogram, and timeline include only raw data items of the first group of raw data items corresponding with the selected at least one shared attribute value or the selected at least one time-based attribute value.

20. The non-transitory computer-readable storage medium of claim 19, wherein the raw data items included in the timeline are associated with all tabs of the plurality of tabs.