Exploratory data analysis system for determination of beaconing risk score

Abstract

A search assistant engine that integrates with a data intake and query system and provides an intuitive user interface to assist a user in searching and evaluating indexed event data. Additionally, the search assistant engine provides logic to determine a mutual information score for field groupings derived from a plurality of fields included within a plurality of events, wherein a mutual information score for a first field grouping a level of diversity between values included in the first field grouping, and dynamically update the GUI resulting in display of an illustration of the field groupings according to a mutual information score of each field grouping. Additional operations may include, receiving additional user input corresponding to a search string, wherein the plurality of events obtained from an index are filtered from a larger set of events based on the search string.