Incident report summary and visualization

Abstract

A network incident summarization and visualization tool presents a summarized or filtered rendering of an analysis or narrative of a collection of events gathered from a stream of incident reports. A graph structure stores entities and relationships between network entities in a graph form based on temporal correspondence between different incidents. An evaluation of the entities and the relationships implements a scoring methodology that identifies the most significant incidents based on the entities and component groups of entities associated by a sequence of relationships. The scoring methodology provides a normalized score that is filtered based on a threshold that removes entities having little to no correspondence or effect. The resulting filtered rendering defines a graph of entities and relationships ordered by type and significance such that the most important aspects of the rendered narrative are apparent.