Performing cybersecurity operations based on impact scores of computing events over a rolling time interval

A computer system for automatically performing security operations associated with a client system based on aggregated event impact scores of computing events during a rolling time interval, the computer system comprising:

• a processor;
• and
• a non-transitory computer readable medium having stored thereon program code for transferring data to another computer system, the program code causing the processor to:
• obtain event data from a plurality of computing devices of the client system associated with computing events occurring during a time interval after an endpoint of the rolling time interval;
• calculate event impact scores for the computing events of the obtained event data over the time interval based at least on cardinality estimation;
• merge the calculated event impact scores into a set of aggregated event impact scores for computing events associated with the rolling time interval;
• remove event impact scores of computing events associated with an expired time interval from the set of aggregated event impact scores;
• and
• perform at least one security operation for at least one computing event based on the set of aggregated event impact scores.

A non-transitory computer storage medium having stored thereon program code executable by a first computer system at a first site, the program code embodying a method comprising:

• obtaining event data from a plurality of computing devices of a client system associated with computing events occurring during a time interval after an endpoint of a rolling time interval;
• calculating event impact scores for the computing events of the obtained event data over the time interval based at least on cardinality estimation;
• merging the calculated event impact scores into a set of aggregated event impact scores for computing events associated with the rolling time interval;
• removing event impact scores of computing events associated with an expired time interval from the set of aggregated event impact scores;
• and
• performing at least one security operation for at least one computing event based on the set of aggregated event impact scores.