Palantir Technologies Inc.

Alexander Visbal

James Thompson

Jason Ma

Ilya Nepomnyashchiy

Marvin Sum

Bing Jie Fu

Steven Berler

Suchan Lee

Alexei Smaliy

Devin Witherspoon

Victoria Lai

John Antonio Carrino

Parvathy Menon

Adam Borochoff

Michael Harris

Michael Kross

Matthew Sprague

Arseny Bogomolov

Cooper Bills

William Rhyne

Jacob Albertson

Clare Adrien

Amr Al Mallah

David Philipson

Kevin Richards

Kevin Simons

Christopher Rogers

Diran Li

Ryan Xie

Matthew Bango

Daniel Campos

Timothy O'Brien

Natasha D'Souza

Victor Hsu

Grigory Bonik

Trevor Austin

Vicktoria Lai

Wayne Chen Spiegel

Gregory Bonik

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, automatically tag and group those clustered data structures, and provide results of the automated analysis and grouping in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a tiled display of the groups of related data clusters such that the analyst may quickly and efficiently evaluate the groups of data clusters. In particular, the groups of data clusters may be dynamically re-grouped and/or filtered in an interactive user interface so as to enable an analyst to quickly navigate among information associated with various groups of data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation.

Systems and user interfaces for dynamic and interactive investigation of bad actor behavior based on automatic clustering of related data in various data structures

A case management system is configured to provide one or more case generation and management functions. As configured, the case management system enables a user to define a workflow, the workflow including one or more states, one or more operations which may be performed at the one or more states, and one or more transitions corresponding to the operations and defining a sequence of the states; to generate and configure a state machine; to receive a workflow identifier to assign to the state machine; and through a command received from a client device, to open and manage a case based on the configuration of the state machine.

Systems and methods for state machine management

Systems and methods are presented for generating a threat score and a usage score of each of a plurality of IP addresses. The threat score may be determined based on quantity of occurrences and recency of each occurrence of an IP address in network alert datasets, in addition to a weighting factor for each data source indicating the accuracy of the data source.

System and method for evaluating network threats and usage

A case management system is configured to generate search templates based on selection of a search type and one or more data sources. As configured, the case management system enables execution of searches using the generated search template on synchronous and asynchronous data sources and provides periodic polling of the asynchronous data sources to generate consolidated search results.

Systems and methods for search template generation

In one embodiment, a data processing method comprises, using a first computer, in response to detecting a change in a data source: automatically generating a dataset comprising a subset of data from the data source, generating a unique dataset identifier, and associating the dataset identifier with the dataset in digital data storage; generating a display description that comprises: the dataset identifier; and for each particular graphical data display widget among one or more graphical data display widgets, instructions that specify a widget type, an order and one or more widget configuration values for the particular graphical data display widget; transmitting the display description to a second computer.

Automatically generating graphical data displays based on structured descriptions

In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster. Further, cluster metascores may be generated based on various cluster scores associated with a cluster. Clusters may be ranked based on cluster metascores. Various embodiments may enable an analyst to discover various insights related to data clusters, and may be applicable to various tasks including, for example, tax fraud detection, beaconing malware detection, malware user-agent detection, and/or activity trend detection, among various others.

Tax data clustering

System and method for evaluating network threats

IP reputation

Growing community of inventors

New York, NY, United States of America

Alexander Visbal