US 11,893,125 B2
Providing a graphical representation of anomalous events
Colin Scott Johnson, San Francisco, CA (US); and Mingran Li, San Jose, CA (US)
Assigned to Cohesity, Inc., San Jose, CA (US)
Filed by Cohesity, Inc., San Jose, CA (US)
Filed on Oct. 14, 2021, as Appl. No. 17/501,617.
Prior Publication US 2023/0117120 A1, Apr. 20, 2023
Int. Cl. G06F 3/048 (2013.01); G06F 21/62 (2013.01); G06F 3/0482 (2013.01); G06F 21/57 (2013.01)
CPC G06F 21/6218 (2013.01) [G06F 3/0482 (2013.01); G06F 21/577 (2013.01); G06F 2221/2101 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
receiving one or more event logs;
analyzing the one or more event logs using a plurality of models to detect one or more anomalous events; and
providing a graphical representation of risk entities associated with at least one of the one or more detected anomalous events, wherein providing the graphical representation includes:
providing in the graphical representation a visual representation of automatically detected relationships between the risk entities associated with the at least one of the one or more detected anomalous events including by providing a first plurality of graphical user interface items corresponding to the risk entities associated with a first detected anomalous event, wherein a first graphical user interface item included in the first plurality of graphical user interface items corresponds to a first risk entity of the risk entities, wherein the first graphical user interface item indicates which model of the plurality of models detected the at least one of the one or more detected anomalous events to be anomalous, wherein the first graphical user interface item is graphically linked to one or more other graphical user interface items of the first plurality of graphical user interface items, wherein the one or more other graphical user interface items correspond to one or more other risk entities of the risk entities associated with the first detected anomalous event; and
providing a corresponding indication of a measure of anomaly associated with the at least one of the one or more detected anomalous events for the risk entities associated with the at least one of the one or more detected anomalous events.