Security analytics mapping operation within a distributed security analytics environment

A system comprising:

• a processor;
• a data bus coupled to the processor;
• and
• a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
• receiving a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity;
• receiving a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity;
• determining, via a distributed security analytics environment, whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity;
• generating, via the distributed security analytics environment, an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity;
• and,
• performing, via the distributed security analytics environment, a security analytics operation, the security analytics operation using the entity interaction map to identify enactment of entity behaviors by the first entity and second entity, the enactment of the entity behaviors by the first entity and the second entity transcending an enactment of an entity behavior by a single entity, the security analytics operation resulting in a security risk assessment for the enactment of the entity behaviors by the first entity and the second entity.

A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

• receiving a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity;
• receiving a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity;
• determining, via a distributed security analytics environment, whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity;
• generating, via the distributed security analytics environment, an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity;
• and,
• performing, via the distributed security analytics environment, a security analytics operation, the security analytics operation using the entity interaction map to identify enactment of entity behaviors by the first entity and second entity, the enactment of the entity behaviors by the first entity and the second entity transcending an enactment of an entity behavior by a single entity, the security analytics operation resulting in a security risk assessment for the enactment of the entity behaviors by the first entity and the second entity.