Outlier detection in enterprise threat detection

A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

• defining a selection of data types from available log data for an evaluation of events associated with an entity;
• defining one or more evaluations associated with the entity;
• generating reference data from the selection of data types based on the one or more defined evaluations;
• grouping the one or more evaluations into a pattern;
• and
• initializing for display in a graphical user interface a visualization of a normalized score for the entity for each evaluation associated with the pattern against a determined anomaly threshold.

A computer-implemented system, comprising:

• a computer memory;
• and
• a hardware processor interoperably coupled with the computer memory and configured to perform operations comprising:
• defining a selection of data types from available log data for an evaluation of events associated with an entity;
• defining one or more evaluations associated with the entity;
• generating reference data from the selection of data types based on the one or more defined evaluations;
• grouping the one or more evaluations into a pattern;
• and
• initializing for display in a graphical user interface a visualization of a normalized score for the entity for each evaluation associated with the pattern against a determined anomaly threshold.