| CPC G06F 16/26 (2019.01) [G06F 9/451 (2018.02); G06F 16/9024 (2019.01); G06Q 50/265 (2013.01)] | 14 Claims |
|
1. A data investigation system configured to provide optimized data viewing for investigations using a network topology of relations between entities, the data investigation system comprising:
a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform investigation mapping operations which comprise:
receiving, from a computing device, an investigation of a first entity using the data investigation system, wherein the first entity comprises a first set of attributes that caused the investigation thereof;
determining, based on the first set of attributes, a plurality of related entities associated with a plurality of events each occurring between the first entity and the plurality of related entities at a respective time;
determining, based on a set of risk calculation rules and a plurality of key performance indicators (KPIs) associated with the investigation, whether each of the plurality of events occurring at the respective time meets or exceeds a risk threshold for the investigation of the first entity;
generating, based on determining whether each of the plurality of events occurring at the respective time meets or exceeds the risk threshold, a first relations graph of the first entity to one or more of the plurality of related entities, wherein the first entity and the one or more of the plurality of related entities determined based on one or more of the plurality of events meeting or exceeding the risk threshold are represented as nodes on the network topology of the first relations graph;
displaying, on the computing device via a first user interface of a relations widget of the data investigation system, the first relations graph;
displaying, on the computing device via a second user interface of the relations widget, a plurality of timestamps associated with the plurality of events, wherein the second user interface comprises a tool to move between the plurality of timestamps from an initial onboarding time of the first entity to a current time;
receiving a selection of one of the plurality of timestamps from the second user interface;
generating a second relations graph in the first user interface based on a subset of the plurality of events that occur prior to or at the one of the plurality of timestamps, wherein the subset of the plurality of events meets or exceeds the risk threshold; and
updating, on the computing device via the first user interface of the relations widget of the data investigation system, the first relations graph to the second relations graph.
|