Software as a service (SaaS) user interface (UI) for displaying user activities in an artificial intelligence (AI)-based cyber threat defense system

An apparatus, comprising:

• a processor;
• and
• a non-transitory computer readable medium including
• a Software as a Service (SaaS) console that, when executed by the processor, configured to retrieves data from one or more application programming interfaces (APIs) hosted by one or more SaaS platforms in order to identify a cyber threat in a cyber threat defense system, the SaaS console is further configured to conduct a regular i) polling service, ii) data retrieval service, and iii) any combination of both and obtain data from the one or more APIs hosted by one or more SaaS platforms to collect event-based activity data from the one or more APIs, wherein the SaaS console is further configured to generate a plurality of SaaS user interfaces (UIs) for visually displaying the collected event-based activity data including at least a SaaS UI used to display a visual representation of the SaaS user activities illustrated as one or more paths interconnecting a series of nodes, where each node represents a file, folder or other storage resource and each of the one or more paths is assigned (i) a color representing normal or anomalous user activity and (ii) a line thickness representing a frequency of use,
• a cyber threat module that, when executed by the processor, configured to detects the cyber threat based on at least a determination whether the event-based activity data identifies behaviors that are different from normal behavior associated with the activity as determined by machine learning models accessible by the cyber threat module, and
• an autonomous response module communicatively coupled to the cyber threat module, the autonomous response module that, when executed by the processor, is configured to generate an autonomous action itself;
• rather than a human, in response to the cyber threats, where the autonomous response module is configured to cause one or more autonomous actions to be taken to contain the cyber threat when a threat risk parameter determined by and provided from the cyber threat module is equal to or above an actionable threshold, where the cyber threat module is configured to cooperate with the autonomous response module, to cause the one or more autonomous actions to be taken to contain the cyber threat by limiting an impact of the cyber threat from consuming unauthorized CPU cycles, memory space, and power consumption in a computing device via responding to the cyber threat without waiting for some human intervention.