Providing a graphical representation of anomalous events

A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

• receiving one or more event logs;
• analyzing the one or more event logs using a plurality of models to detect one or more anomalous events;
• and
• providing a graphical representation of risk entities associated with at least one of the one or more detected anomalous events, wherein providing the graphical representation includes:
• providing in the graphical representation a visual representation of automatically detected relationships between the risk entities associated with the at least one of the one or more detected anomalous events including by providing a first plurality of graphical user interface items corresponding to the risk entities associated with a first detected anomalous event, wherein a first graphical user interface item included in the first plurality of graphical user interface items corresponds to a first risk entity of the risk entities, wherein the first graphical user interface item indicates which model of the plurality of models detected the at least one of the one or more detected anomalous events to be anomalous, wherein the first graphical user interface item is graphically linked to one or more other graphical user interface items of the first plurality of graphical user interface items, wherein the one or more other graphical user interface items correspond to one or more other risk entities of the risk entities associated with the first detected anomalous event;
• and
• providing a corresponding indication of a measure of anomaly associated with the at least one of the one or more detected anomalous events for the risk entities associated with the at least one of the one or more detected anomalous events.

A system, comprising:

• one or more processors configured to:
• receive one or more event logs;
• analyze the one or more event logs using a plurality of models to detect one or more anomalous events;
• and
• provide a graphical representation of risk entities associated with at least one of the one or more detected anomalous events, wherein to provide the graphical representation the one or more processors are configured to:
• provide in the graphical representation a visual representation of automatically detected relationships between the risk entities associated with the at least one of the one or more detected anomalous events including by providing a first plurality of graphical user interface items corresponding to the risk entities associated with a first detected anomalous event, wherein a first graphical user interface item included in the first plurality of graphical user interface items corresponds to a first risk entity of the risk entities, wherein the first graphical user interface item indicates which model of the plurality of models detected the at least one of the one or more detected anomalous events to be anomalous, wherein the first graphical user interface item is graphically linked to one or more other graphical user interface items of the first plurality of graphical user interface items, wherein the one or more other graphical user interface items correspond to one or more other risk entities of the risk entities associated with the first detected anomalous event;
• and
• provide a corresponding indication of a measure of anomaly associated with the at least one of the one or more detected anomalous events for the risk entities associated with the at least one of the one or more detected anomalous events;
• and
• a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.