System event detection system and method

A computing system comprising:

• a hardware computer processor;
• and
• a non-transitory computer readable medium having software instructions stored thereon, the software instructions executable by the hardware computer processor to cause the computing system to perform operations comprising:
• receiving from a server:
• a plurality of properties associated with a detected suspicious system event, the plurality of properties including one or more:
• event properties associated with the detected suspicious system event, properties of a first system, or vulnerability properties associated with the first system;
• and
• for each of the plurality of properties, a corresponding plurality of property values;
• displaying a user interface indicating the plurality of property values and a plurality of user interface elements corresponding to the plurality of property values;
• receiving user input of one or more user interface elements indicating selection of one or more corresponding property values;
• and
• responsive to the user input, initiating generation of one or more new event detectors by sending, to the server, a selection indicator indicating the selected one or more property values, wherein the one or more new event detectors are based on the one or more property values selected by user input, and wherein the new event detectors are configured to detect suspicious system events.

A non-transitory computer readable medium having software instructions stored thereon, the software instructions executable by a hardware computer processor to cause a computing system to perform operations comprising:

• receiving a plurality of system event records;
• processing the plurality of system event records using a set of event detectors to determine that a suspicious system event associated with a first system has occurred;
• determining, for each of a plurality of properties associated with the suspicious system event, a corresponding plurality of property values, wherein the plurality of properties include one or more event properties associated with the suspicious system event, properties of the first system, or vulnerability properties associated with the first system;
• sending, to a client device, the determined plurality of property values associated with the suspicious system event, wherein the plurality of property values are displayed on a user interface comprising a plurality of user interface elements corresponding to the plurality of properties;
• receiving, from the client device, one or more property values selected by user input via the user interface;
• initiating generation of one or more new event detectors based on the one or more property values selected by user input;
• and
• adding the one or more new event detectors to the set of event detectors.