Systems and user interfaces for dynamic and interactive investigation based on automatic clustering of related data in various data structures

A computer system comprising:

• one or more computer readable storage devices configured to store:
• host-based events associated with one or more computing devices;
• and
• activity trend-related data items;
• and
• one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute computer executable instructions to cause the computer system to:
• determine a first group of host-based events that indicate a same first activity type and are associated with a first host and a reference time period;
• determine, based at least on the first group of host-based events, a first statistical deviation in the first activity type on the first host for the reference time period;
• determine a second group of host-based events the indicate the same first activity type and are associated with the first host and a test time period;
• determine, based at least on the second group of host-based events, a second statistical deviation in the first activity type on the first host for the test time period;
• in response to determining that the first statistical deviation compared to the second statistical deviation satisfies a particular threshold, designate a host-based event from the second group as a seed;
• and
• generate a data item cluster based on the seed, wherein generating the data item cluster comprises:
• adding the seed to the data item cluster;
• and
• adding to the data item cluster one or more activity trend-related data items, from the activity trend-related data items, determined to be associated with the seed.

A computer-implemented method comprising:

• by one or more processors executing program instructions:
• accessing one or more computer readable storage devices configured to store:
• host-based events associated with one or more computing devices;
• and
• activity trend-related data items;
• determining a first group of host-based events that indicate a same first activity type and are associated with a first host and a reference time period;
• determining, based at least on the first group of host-based events, a first statistical deviation in the first activity type on the first host for the reference time period;
• determining a second group of host-based events the indicate the same first activity type and are associated with the first host and a test time period;
• determining, based at least on the second group of host-based events, a second statistical deviation in the first activity type on the first host for the test time period;
• in response to determining that the first statistical deviation compared to the second statistical deviation satisfies a particular threshold, designating a host-based event from the second group as a seed;
• and
• generating a data item cluster based on the seed, wherein generating the data item cluster comprises:
• adding the seed to the data item cluster;
• and
• adding to the data item cluster one or more activity trend-related data items, from the activity trend-related data items, determined to be associated with the seed.

A computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to:

• access one or more computer readable storage devices configured to store:
• host-based events associated with one or more computing devices;
• and
• activity trend-related data items;
• determine a first group of host-based events that indicate a same first activity type and are associated with a first host and a reference time period;
• determine, based at least on the first group of host-based events, a first statistical deviation in the first activity type on the first host for the reference time period;
• determine a second group of host-based events the indicate the same first activity type and are associated with the first host and a test time period;
• determine, based at least on the second group of host-based events, a second statistical deviation in the first activity type on the first host for the test time period;
• in response to determining that the first statistical deviation compared to the second statistical deviation satisfies a particular threshold, designate a host-based event from the second group as a seed;
• and
• generate a data item cluster based on the seed, wherein generating the data item cluster comprises:
• adding the seed to the data item cluster;
• and
• adding to the data item cluster one or more activity trend-related data items, from the activity trend-related data items, determined to be associated with the seed.