Detecting suspicious file activity

A system for identifying anomalous data events, comprising:

• at least one processor;
• and
• memory including instructions that, when executed by the at least one processor, cause the at least one processor to:
• monitor a networked file system for suspicious events;
• receive an indication of a suspicious event associated with a user and a file;
• perform a pattern of behavior analysis using historical events associated with the user;
• perform an adjacency by time analysis using a set of events for the user before the suspicious event and a set of events for the user after the suspicious event;
• perform an adjacency by storage location analysis using a set of files located in a storage location of the file;
• determine whether the suspicious event is an anomalous event based on the pattern of behavior analysis, the adjacency by time analysis, and the adjacency by storage location analysis;
• display a report for the user including the anomalous event;
• identify, through the adjacency by time analysis, a second user associated with the file;
• perform a second pattern of behavior analysis using historical events associated with the second user;
• perform a second adjacency by time analysis using a set of events for the second user before the suspicious event and a set of events for the second user after the suspicious event;
• perform a second adjacency by storage location analysis using a set of files located in a storage location, associated with the second user, of the file;
• determine if the suspicious event is a second anomalous event based on the second pattern of behavior analysis, the second adjacency by time analysis, and the second adjacency by storage location analysis;
• and
• display a second report for the user and the second user including the second anomalous event.

At least one computer readable medium including instructions for identifying anomalous data events that when executed by at least one processor, cause the at least one processor to:

• monitor a networked file system for suspicious events;
• receive an indication of a suspicious event associated with a user and a file;
• perform a pattern of behavior analysis using historical events associated with the user;
• perform an adjacency by time analysis using a set of events for the user before the suspicious event and a set of events for the user after the suspicious event;
• perform an adjacency by storage location analysis using a set of files located in a storage location of the file;
• determine whether the suspicious event is an anomalous event based on the pattern of behavior analysis, the adjacency by time analysis, and the adjacency by storage location analysis;
• display a report for the user including the anomalous event;
• identify, through the adjacency by time analysis, a second user associated with the file;
• perform a second pattern of behavior analysis using historical events associated with the second user;
• perform a second adjacency by time analysis using a set of events for the second user before the suspicious event and a set of events for the second user after the suspicious event;
• perform a second adjacency by storage location analysis using a set of files located in a storage location, associated with the second user, of the file;
• determine if the suspicious event is a second anomalous event based on the second pattern of behavior analysis, the second adjacency by time analysis, and the second adjacency by storage location analysis;
• and
• display a second report for the user and the second user including the second anomalous event.