Investigation of threats using queryable records of behavior

A non-transitory medium with instructions stored thereon that, when executed by a processor of a computing device, cause the computing device to perform operations comprising:

• receiving input that is indicative of a query for records of digital activities that satisfy a criterion;
• accessing a datastore that includes digital profiles for accounts associated with employees of an enterprise,
• wherein each digital profile includes a series of records of digital activities that have been performed with a corresponding account on a channel through which the employees are able to communicate, and
• wherein each series of records is representative of a historical summary of conduct by the corresponding account that provides insight into whether behavior of the corresponding account changed over a given interval of time;
• searching the datastore to identify at least one record that satisfies the query;
• and
• causing display of an interface that includes information related to the at least one record.

A method for managing a datastore in which digital profiles that are representative of historical models of behavior of accounts are stored, the method comprising:

• establishing, via an application programming interface, a connection with a datastore that is associated with a given channel through which employees of an enterprise are able to communicate;
• obtaining, in real time via the application programming interface, data associated with a communication transmitted on the given channel to an account that is associated with an employee;
• generating a record of the communication by populating a data structure with multiple attributes of the communication;
• and
• populating the record into a digital profile associated with the account,
• wherein the digital profile is representative of a historical summary of all conduct on the given channel by the account over an interval of time.

A system comprising:

• a processor configured to:
• obtain data that is related to a series of digital activities performed with accounts on a channel through which employees of an enterprise are able to communicate;
• parse the data to discover an attribute of each digital activity;
• determine a threat posed by each digital activity based on the corresponding attribute;
• generate a record of each digital activity by populating a data structure with (i) the corresponding attribute and (ii) an indication of the threat posed to the enterprise, so as to generate a series of records;
• associate the series of records with the accounts by appending an identifier to each record that is representative of the corresponding account;
• and
• populate the series of records into digital profiles that are maintained for the accounts, so as to develop, for each account, a historical summary of all conduct on the channel that provides insight into behavior of each account on the channel over time;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.

A system, comprising:

• a processor configured to:
• receive input that is indicative of a query for records of digital activities that satisfy a criterion;
• access a datastore that includes digital profiles for accounts associated with employees of an enterprise, wherein each digital profile includes a series of records of digital activities that have been performed with a corresponding account on a channel through which the employees are able to communicate, and wherein each series of records is representative of a historical summary of conduct by the corresponding account that provides insight into whether behavior of the corresponding account changed over a given interval of time;
• search the datastore to identify at least one record that satisfies the query;
• and
• cause display of an interface that includes information related to the at least one record;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.

A method, comprising:

• receiving input that is indicative of a query for records of digital activities that satisfy a criterion;
• accessing a datastore that includes digital profiles for accounts associated with employees of an enterprise, wherein each digital profile includes a series of records of digital activities that have been performed with a corresponding account on a channel through which the employees are able to communicate, and wherein each series of records is representative of a historical summary of conduct by the corresponding account that provides insight into whether behavior of the corresponding account changed over a given interval of time;
• searching the datastore to identify at least one record that satisfies the query;
• and
• causing display of an interface that includes information related to the at least one record.

A system, comprising:

• a processor configured to:
• establish, via an application programming interface, a connection with a datastore that is associated with a given channel through which employees of an enterprise are able to communicate;
• obtain, in real time via the application programming interface, data associated with a communication transmitted on the given channel to an account that is associated with an employee;
• generate a record of the communication by populating a data structure with multiple attributes of the communication;
• and
• populate the record into a digital profile associated with the account, wherein the digital profile is representative of a historical summary of all conduct on the given channel by the account over an interval of time;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.