Audit log report generator

A system comprising:

• one or more modules implemented by one or more processors of a client system, the one or more modules configured to perform operations for generating a supplemental user interface for presentation on a client device in conjunction with a primary user interface presented on the client device, the supplemental user interface including custom data fields to assist a user in completion of investigative steps pertaining to an alert presented in the primary user interface, the operations comprising:
• determining that the alert has been received from a server system and presented in the primary user interface, the alert identifying a suspicious activity that is to be reviewed by the user;
• selecting a template for the supplemental user interface from a plurality of templates based on a type of the alert;
• accessing the template for the supplemental user interface, the template including database queries and instructions for presenting data items derived from query results corresponding to the database queries in the custom data fields, the instructions include a mapping of the data items to the custom data fields and a layout for the custom data fields within the supplemental user interface, wherein the database queries are specified in a front-end query language;
• consolidating two or more of the database queries into an additional database query specified in a back-end query language;
• and
• receiving query results corresponding to the additional database query;
• presenting the data items derived from the query results in the custom data fields of the supplemental user interface based on the instructions included in the template;
• and
• updating an audit log based on an acceptance by the user of the data items presented in the custom data fields of the supplemental user interface.

A non-transitory machine readable medium comprising a set of instructions that, when executed by one or more processors of a client system, causes the one or more processors to perform operations for generating a supplemental user interface for presentation on a client device in conjunction with a primary user interface presented on the client device, the supplemental user interface including custom data fields to assist a user in completion of investigative steps pertaining to an alert presented in the primary user interface, the operations comprising, the operations comprising:

• determining that the alert has been received from a server system and presented in the primary user interface, the alert identifying a suspicious activity that is to be reviewed by the user;
• selecting a template for the supplemental user interface from a plurality of templates based on a type of the alert;
• accessing the template for the supplemental user interface, the template including database queries and instructions for presenting data items derived from query results corresponding to the database queries in the custom data fields, the instructions include a mapping of the data items to the custom data fields and a layout for the custom data fields within the supplemental user interface, wherein the database queries are specified in a front-end query language;
• consolidating two or more of the database queries into an additional database query specified in a back-end query language;
• and
• receiving query results corresponding to the additional database query;
• presenting the data items derived from the query results in the custom data fields of the supplemental user interface based on the instructions included in the template;
• and
• updating an audit log based on an acceptance by the user of the data items presented in the custom data fields of the supplemental user interface.