Palantir Technologies Inc.

Jason Ma

James Thompson

Ilya Nepomnyashchiy

Bing Jie Fu

Steven Berler

David Cohen

Parvathy Menon

Adam Borochoff

Michael Harris

Jack Grossman

Michael Kross

Matthew Sprague

Alex Smaliy

Julia Boortz

Allen Cai

Myles Scolnick

Brian Lee

Alexander Visbal

Marvin Sum

Hind Kraytem

Suchan Lee

Evan Minamoto

Zhixian Shen

Devin Witherspoon

Alexei Smaliy

Benjamin Lee

Victoria Lai

Aaron Davidson

David Skiff

Greg DeArment

Vivek Lakshmanan

Guodong Xu

Mahmoud Abdelsalam

Christopher Yu

Ryan McNamara

Ashray Jain

Tarik Benabdallah

Andrew Cooper

Stefan Negrus

Arnaud Drizard

Ludovic Lay

Radu-Andrei Szasz

Damian Rusak

Damien Cramard

Jan Matas

Taylor Cathcart

Richard Allen Ducott, Iii

Tony Poor

Alexander Landau

Greg Dearment

Vicktoria Lai

Ryan Mcnamara

Embodiments of the present disclosure relate to user interfaces and systems that may enable dynamic and interactive access of, investigation of, and analysis of data objects stored in one or more databases. The data objects may be accessed from the one or more databases, and presented in multiple related portions of a display. In particular, the system provides a time-based visualization of data objects (and/or properties associated with the data objects) to a user such that the user may, for example, determine connections between various data objects, observe flows of information among data objects, and/or investigate related data objects.

Systems and user interfaces for dynamic and interactive access of, investigation of, and analysis of data objects stored in one or more databases

System and method for terminating instances and autoscaling instance groups of computing platforms. For example, a method includes determining whether an instance of an instance group is identified as eligible for termination. The method further includes, in response to determining that the instance of the instance group is identified as eligible for termination, terminating the eligible instance. The terminating the eligible instance includes, in response to a runtime of the eligible instance being equal to or larger than a predetermined maximum lifetime, terminating the eligible instance. The terminating the eligible instance further includes, in response to the runtime being smaller than the predetermined maximum lifetime, detaching the eligible instance from the instance group to allow a new instance to be associated with the instance group, and in response to the eligible instance being detached from the instance group: waiting for the new instance to be associated with the instance group, and evicting each pod associated with the detached instance. The method is performed using one or more processors.

Systems and methods for autoscaling instance groups of computing platforms

Disclosed are data gathering and analysis systems, methods, and computer-readable storage media to facilitate an investigation process. The method includes accessing a data object representing an investigative issue as part of initiating an investigative session. The method further includes causing presentation, on a display of a device, of a user interface configured to receive user search queries and present search results for each received search query. The method further includes tracking user activity including one or more user actions performed during the investigative session. The method further includes creating a record of the user activity, and linking the record of the user activity with the data object representing the investigative issue.

Data analysis system to facilitate investigative process

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, and provide results of the automated analysis in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a compact, human-readable analysis of the data clusters. The human-readable analyses (also referred to herein as 'summaries' or “conclusions”) of the data clusters may be organized into an interactive user interface so as to enable an analyst to quickly navigate among information associated with various data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation. Embodiments of the present disclosure also relate to automated scoring of the clustered data structures.

Phishing data item clustering and analysis

Systems are provided for managing defect data objects. A system stores a plurality of defect data objects that have been input to the system, and generates an issue item including one or more defect data objects that are selected from the stored defect data objects based on user input. The system determines similarity between the one or more defect data objects in the issue item and one or more of the stored defect data objects that are out of the issue item, based on comparison of one or more parameter values. The system determines one or more candidate defect data objects to be included in the issue item from the one or more of the stored defect data objects that are out of the issue item based on the similarity, and includes one or more of the determined candidate defect data objects in the issue item based on user input.

User-interactive defect analysis for root cause

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, automatically tag and group those clustered data structures, and provide results of the automated analysis and grouping in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a tiled display of the groups of related data clusters such that the analyst may quickly and efficiently evaluate the groups of data clusters. In particular, the groups of data clusters may be dynamically re-grouped and/or filtered in an interactive user interface so as to enable an analyst to quickly navigate among information associated with various groups of data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation.

Systems and user interfaces for dynamic and interactive investigation of bad actor behavior based on automatic clustering of related data in various data structures

Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, and provide results of the automated analysis in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a compact, human-readable analysis of the data clusters. The human-readable analyses (also referred to herein as 'summaries' or 'conclusions') of the data clusters may be organized into an interactive user interface so as to enable an analyst to quickly navigate among information associated with various data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation. Embodiments of the present disclosure also relate to automated scoring of the clustered data structures.

An event matrix may comprise labels and indicators corresponding to objects and links of an ontology. The objects and links may be determined from a plurality of data sources by a data integration system. Some of the labels may correspond to event objects, and may be arranged in a first spatial dimension at least in part on the basis of dates associated with said event objects. Other labels may correspond to non-event objects, and may be arranged in a second spatial dimension. Indicators may correspond to links between the event and non-event objects. An indicator for a particular link may be positioned with respect to the first and second spatial dimensions in accordance with the locations of the labels that correspond to the objects connected by the link.

System and method for generating event visualizations

External malware data item clustering and analysis

Growing community of inventors

Mountain View, CA, United States of America

Jason Ma