Generating security event case files from disparate unstructured data

Abstract

Described herein are systems and methods for generating security event case files with unstructured data. For example, the method can include receiving, by a computing system, unstructured data and system-based inferences from devices positioned throughout a store, and adding structure to the unstructured data and system-based inferences based on applying one or more structuring models. Adding structure can include labeling the data and system-based inferences, classifying them into security event categories, and identifying objective identifiers to identify users in the data and system-based inferences. The method also can include generating case files for each of the objective identifiers, where the case files include the associated data. The method can include determining whether the case files satisfy alerting rules. The case files can then be reported out and acted upon (e.g., based on satisfying the alerting rules) and/or stored for subsequent analysis and use.