Investigation timeline builder for dynamic entity data visualizations in user interfaces

A method to provide optimized data viewing for investigations using a network topology of relations between entities using a data investigation system, the method comprising:

• receiving, from a computing device, an investigation of a first entity using the data investigation system, wherein the first entity comprises a first set of attributes that caused the investigation thereof;
• determining, based on the first set of attributes, a plurality of related entities associated with a plurality of events each occurring between the first entity and the plurality of related entities at a respective time;
• determining, based on a set of risk calculation rules and a plurality of key performance indicators (KPIs) associated with the investigation, whether each of the plurality of events occurring at the respective time meets or exceeds a risk threshold for the investigation of the first entity;
• generating, based on determining whether each of the plurality of events occurring at the respective time meets or exceeds the risk threshold, a first relations graph of the first entity to one or more of the plurality of related entities, wherein the first entity and the one or more of the plurality of related entities determined based on one or more of the plurality of events meeting or exceeding the risk threshold are represented as nodes on the network topology of the first relations graph;
• displaying, on the computing device via a first user interface of a relations widget of the data investigation system, the first relations graph;
• displaying, on the computing device via a second user interface of the relations widget, a plurality of timestamps associated with the plurality of events, wherein the second user interface comprises a tool to move between the plurality of timestamps from an initial onboarding time of the first entity to a current time;
• receiving a selection of one of the plurality of timestamps from the second user interface;
• generating a second relations graph in the first user interface based on a subset of the plurality of events that occur prior to or at the one of the plurality of timestamps, wherein the subset of the plurality of events meets or exceeds the risk threshold;
• and
• updating, on the computing device via the first user interface of the relations widget of the data investigation system, the first relations graph to the second relations graph.

A non-transitory computer-readable medium having stored thereon computer-readable instructions executable to provide optimized data viewing for investigations using a network topology of relations between entities using a data investigation system, the computer-readable instructions executable to perform investigation mapping operations which comprises:

• receiving, from a computing device, an investigation of a first entity using the data investigation system, wherein the first entity comprises a first set of attributes that caused the investigation thereof;
• determining, based on the first set of attributes, a plurality of related entities associated with a plurality of events each occurring between the first entity and the plurality of related entities at a respective time;
• determining, based on a set of risk calculation rules and a plurality of key performance indicators (KPIs) associated with the investigation, whether each of the plurality of events occurring at the respective time meets or exceeds a risk threshold for the investigation of the first entity;
• generating, based on determining whether each of the plurality of events occurring at the respective time meets or exceeds the risk threshold, a first relations graph of the first entity to one or more of the plurality of related entities, wherein the first entity and the one or more of the plurality of related entities determined based on one or more of the plurality of events meeting or exceeding the risk threshold are represented as nodes on the network topology of the first relations graph;
• displaying, on the computing device via a first user interface of a relations widget of the data investigation system, the first relations graph;
• displaying, on the computing device via a second user interface of the relations widget, a plurality of timestamps associated with the plurality of events, wherein the second user interface comprises a tool to move between the plurality of timestamps from an initial onboarding time of the first entity to a current time;
• receiving a selection of one of the plurality of timestamps from the second user interface;
• generating a second relations graph in the first user interface based on a subset of the plurality of events that occur prior to or at the one of the plurality of timestamps, wherein the subset of the plurality of events meets or exceeds the risk threshold;
• and
• updating, on the computing device via the first user interface of the relations widget of the data investigation system, the first relations graph to the second relations graph.