Generative artificial intelligence-based multi-stage composite event processing

A computer program product embodied in a non-transitory computer-readable storage medium and comprising computer instructions for a data platform to perform a process comprising:

• accessing event data representative of a plurality of events that occur within a compute environment;
• analyzing, using a first event analyzer that operates in accordance with a first analysis heuristic, a first set of one or more events included in the plurality of events to generate a first output signal;
• analyzing, using a second event analyzer that operates in accordance with a second analysis heuristic, a second set of one or more events included in the plurality of events to generate a second output signal;
• analyzing, using a third event analyzer that operates in accordance with a third analysis heuristic, the first and second output signals to generate a composite alert signal indicative of whether the first set of one or more events and the second set of one or more events are together indicative of one or more intrusions that are severe enough to be alerted on;
• and
• performing, based on the composite alert signal, an alert-based operation with respect to the plurality of events.

A system comprising:

• memory storing instructions;
• and
• one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:
• accessing event data representative of a plurality of events that occur within a compute environment;
• analyzing, using a first event analyzer that operates in accordance with a first analysis heuristic, a first set of one or more events included in the plurality of events to generate a first output signal;
• analyzing, using a second event analyzer that operates in accordance with a second analysis heuristic, a second set of one or more events included in the plurality of events to generate a second output signal;
• analyzing, using a third event analyzer that operates in accordance with a third analysis heuristic, the first and second output signals to generate a composite alert signal indicative of whether the first set of one or more events and the second set of one or more events are together indicative of one or more intrusions that are severe enough to be alerted on;
• and
• performing, based on the composite alert signal, an alert-based operation with respect to the plurality of events.