Splunk Inc.

Cisco Technology, Inc.

Gleb Esman

Oleg Izmerly

Various embodiments of the present invention set forth techniques for monitoring risk in a computing system. The technique includes creating one or more risk objects, where each risk object of the one or more risk objects has a corresponding stored risk definition, the stored risk definition associating the risk object with raw machine data pertaining to the risk object, the raw machine data reflecting activity in an information technology (IT) environment. The technique further includes receiving a selection of a first risk object included in the one or more risk objects and receiving a first risk definition that corresponds to the first risk object. The technique further includes performing a search of the raw machine data according to the first risk definition, wherein a risk is identified based on the search of the raw machine data and performing an action based on identifying the risk.

Risk analysis using risk definition relationships

Embodiments of the present invention set forth a technique for predicting fraud based on multiple inputs including user behavior biometric data along with one or more other parameters associated with the user. The technique includes receiving cursor movement data generated via a client device. The technique further includes generating a image based on the cursor movement data. The technique further includes receiving client parameters generated via the client device. The technique further includes analyzing the image and the client parameters based on a model to generate a prediction result, where the model is generated based on second cursor movement data and a second set of client parameters associated with a first group of one or more users. The technique further includes determining, based on the prediction result, that a user of the client device is not a member of the first group.

Multiple input neural networks for detecting fraud

A schema consistency mechanism monitors data ingested by a data intake and query system for changes to the structure, or data schema, associated with the data. A schema consistency monitor obtains data from a data source (or, more generally, from any number of separate data sources) at a plurality of points in time. The data is analyzed to determine whether a first portion of the data received at a first point in time conforms to a first data schema and that a second portion of the data received at a second point in time conforms to a second data schema that is different from the first data schema (thereby indicating a change to the associated data schema). A graphical user interface (GUI) can be generated that includes indications of identified changes to one or more data schemas associated with data.

Generating schema change alerts in a data intake and query system

Medication security and healthcare privacy analytics systems are described that enable users to search for and process stored healthcare environment data. The medication security and healthcare privacy analytics systems receive and correlate data from a plurality of data sources, including medication dispensing systems, healthcare employee records, and patient records. The medication security and healthcare privacy analytics systems generate a plurality of feature vectors from processed healthcare environment data. The visualizations are created using datasets generated by clustering algorithms and can indicate those feature vectors from the plurality of feature vectors whose data indicate anomalous interactions with various systems (e.g., indicative of unexpected or non-customary events).

Visualizing anomalous feature vectors based on data from healthcare records systems

The disclosed embodiments relate to systems and methods that provides a dashboard that includes multiple independent panels where each independent panel functions independently and is associated with a respective search query that when executed generates data that may populate and/or configure the associated panel. The systems and methods further permits generation of a filter condition based on user input provided through a single panel and automatically apply the filter condition to the queries of some or all of the queries of the independent panels of the dashboard and execute the updated queries to update some or all of the independent panels.

Updating and executing search queries of multiple independent panels of a dashboard

One embodiment of the present invention sets forth a technique for predicting fraud by correlating user behavior biometric data with one or more other types of data. The technique includes receiving cursor movement data generated via a client device and analyzing the cursor movement data based on a model to generate a result. The model may be generated based on cursor movement data associated with a first group of one or more users. The technique further includes receiving log data generated via the client device and determining, based on the result and the log data, that a user of the client device is not a member of the first group.

Detecting fraud by correlating user behavior biometrics with other data sources

Modifying event generation rules responsive to detected schema changes

Medication security and healthcare privacy analytics systems are described that enable users to search for and process stored healthcare environment data. The medication security and healthcare privacy analytics systems receive and correlate data from a plurality of data sources, including medication dispensing systems, healthcare employee records, and patient records, including user behavior or interaction data with the foregoing data sources. The medication security and healthcare privacy analytics systems include graphical user interfaces (GUIs) that enable users to select elements to filter the processed healthcare environment data and generate visualizations of filtered datasets. The visualizations are created using datasets generated by clustering algorithms and can indicate those users from a plurality of users whose interactions with various systems are anomalous (e.g., indicative of unexpected or non-customary user behavior).

Medication security and healthcare privacy systems

Risk monitoring system

One embodiment of the present invention sets forth a technique for predicting fraud by analyzing user behavior biometric data via a neural network (NN). The technique includes receiving cursor movement data generated via at least one client device, where the cursor movement data is associated with a group of one or more users. The technique further includes generating a plurality of images based on the cursor movement data and training a first neural network (NN) model based on the plurality of images and based on a discard rate that is greater than 50%.

Growing community of inventors

San Francisco, CA, United States of America

Gleb Esman