Enhanced data aggregation techniques for anomaly detection and analysis

A system for implementing anomaly detection rules, comprising:

• at least one processor;
• and
• at least one memory in communication with the at least one processor, the at least one memory having computer-readable instructions stored thereupon that, when executed by the at least one processor, cause the at least one processor to:
• cause a device to display a rule-generation graphical user interface (GUI) that enables at least one user to:
• define an anomaly detection rule that associates an occurrence threshold with predefined values for a user-selected subset of a plurality of variables that correspond to an aggregation table;
• and
• set one or more parameters for generating a post-analysis table in association with the anomaly detection rule;
• generate, within the aggregation table, an individual rule row that corresponds to the anomaly detection rule, wherein the individual rule row indicates the predefined values for the user-selected subset of the plurality of variables, and wherein the individual rule row indicates a null subset of the plurality of variables;
• receive event data that indicates for individual events, of a plurality of events, individual values corresponding to at least some of the plurality of variables;
• aggregate the event data into the aggregation table by setting a rule satisfaction count, for the individual rule row, when the individual values match the predefined values;
• and
• responsive to a determination that the rule satisfaction count exceeds the occurrence threshold during a time window, generate the post-analysis table in accordance with the one or more parameters;
• and
• generate a notification that indicates that the rule satisfaction count exceeded the occurrence threshold during the time window, wherein the notification indicates an availability of the post-analysis table to the at least one user.

A computer-implemented method, comprising:

• causing a device to display a rule-generation graphical user interface (GUI) that enables at least one user to define an anomaly detection rule and to one or more parameters for generating a post-analysis table in association with the anomaly detection rule;
• generating an aggregation table that includes an individual rule row that corresponds to the anomaly detection rule, wherein the individual rule row indicates the predefined values for a user-selected subset of a plurality of variables;
• receiving event data that indicates for individual events, of a plurality of events, individual values corresponding to at least some of the plurality of variables;
• aggregate the event data into the aggregation table by setting a rule satisfaction count for the individual rule row;
• and
• generating the post-analysis table in accordance with the one or more parameters responsive to a determination that the rule satisfaction count exceeds an occurrence threshold.