Identifying anomalies within streamed security-alert data based on retroactively obtained data-transformation information

Abstract

Methods and systems are described herein for identifying anomalies within streamed event-based time-series data based on retroactively captured data lineage information. For example, the system may receive a request to identify an anomaly associated with a security-event-based time-series. The system may obtain the security-event-based time-series comprising a set of security-alerts further comprising security-alert data. Then the system may store the security-alert data for each security-alert in a database according to a schema. The system may then populate, based on the schema, a set of predefined prompts sections with the security-alert data of the set of security-alerts. The system may then identify the anomaly associated with the security-event-based time-series based on a summary generated by an artificial intelligence model using the set of predefined prompts. The system may then transmit a second notification comprising an indication of the identified anomaly to a user device associated with the user.