Detecting and responding to an anomaly in an event log

A computer program product comprising a computer readable storage medium having program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, and wherein the program code is readable and executable by a processor to perform a method comprising:

• receiving monitoring logs from an endpoint log source;
• identifying anomalies in the monitoring logs by executing a plurality of disparate types of unsupervised machine learning (ML) trained anomaly detection artificial intelligence (AI) computer models on the monitoring logs, each unsupervised ML trained anomaly detection AI computer model automatically generating an output, for each monitoring log, indicating a measure of a likelihood that the monitoring log is anomalous;
• determining a likelihood that the identified anomalies are actually anomalous based on a combination of the outputs from the plurality of disparate types of unsupervised ML trained anomaly detection AI computer models;
• prioritizing the monitoring logs based on the determined likelihood that the identified anomalies are actually anomalous as determined by the combination of the outputs of the plurality of disparate types of unsupervised ML trained anomaly detection AI computer models;
• and
• sending prioritized monitoring logs that exceed a priority level to a security information and event management (SIEM) computing system.

A computer system comprising one or more processors, one or more computer readable memories, and one or more computer readable non-transitory storage mediums, and program instructions stored on at least one of the one or more computer readable non-transitory storage mediums for execution by at least one of the one or more processors via at least one of the one or more computer readable memories, the stored program instructions executed to perform a method comprising:

• receiving monitoring logs from an endpoint log source;
• identifying anomalies in the monitoring logs by executing a plurality of disparate types of unsupervised machine learning (ML) trained anomaly detection artificial intelligence (AI) computer models on the monitoring logs, each unsupervised ML trained anomaly detection AI computer model automatically generating an output, for each monitoring log, indicating a measure of a likelihood that the monitoring log is anomalous;
• determining a likelihood that the identified anomalies are actually anomalous based on a combination of the outputs from the plurality of disparate types of unsupervised ML trained anomaly detection AI computer models;
• prioritizing the monitoring logs based on the determined likelihood that the identified anomalies are actually anomalous as determined by the combination of the outputs of the plurality of disparate types of unsupervised ML trained anomaly detection AI computer models;
• and
• sending prioritized monitoring logs that exceed a priority level to a security information and event management (SIEM) computing system.