US 11,698,961 B2
System event detection system and method
Andrew Eggleton, Sydney (AU); Elliot Colquhoun, Auckland (NZ); Ranec Highet, London (GB); Xiao Tang, Singapore (SG); Tareq Alkhatib, Richmond (CA); Raj Krishnan, Doha (QA); Nik Seetharaman, Sydney (AU); Brandon Helms, Washington, DC (US); Gautam Punukollu, New York, NY (US); and Morten Kromann, Doha (QA)
Assigned to Palantir Technologies Inc., Denver, CO (US)
Filed by Palantir Technologies Inc., Denver, CO (US)
Filed on Aug. 23, 2019, as Appl. No. 16/549,261.
Claims priority of application No. 1910654 (GB), filed on Jul. 25, 2019.
Prior Publication US 2021/0026952 A1, Jan. 28, 2021
Int. Cl. G06F 21/00 (2013.01); G06F 21/55 (2013.01); G06F 21/57 (2013.01)
CPC G06F 21/552 (2013.01) [G06F 21/577 (2013.01); G06F 2221/034 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A method, performed by one or more processors, comprising:
receiving a plurality of system event records;
processing the plurality of system event records using a set of event detectors to determine that a suspicious system event associated with a first system has occurred;
determining, for each of a plurality of properties associated with the suspicious system event, a corresponding plurality of property values, wherein the plurality of properties include one or more event properties associated with the suspicious system event, properties of the first system, or vulnerability properties associated with the first system;
sending, to a client device, the determined plurality of property values associated with the suspicious system event, wherein the plurality of property values are displayed on a user interface comprising a plurality of user interface elements corresponding to the plurality of properties;
receiving, from the client device, user input of one or more user interface elements indicating a selected one or more property values of the plurality of property values associated with the suspicious system event;
in response to receiving the one or more property values selected by user input, initiating generation of one or more new event detectors based on the one or more property values selected by user input; and
adding the one or more new event detectors to the set of event detectors.