Interface Providing An Interactive Trendline For A Detected Threat to Facilitate Evaluation For False Positives

A method comprising:

• receiving event data generated by network activities of entities that interact with a computer network, wherein the event data comprises machine data, and the entities include computer users and/or devices in communication with the network;
• based upon the received event data as it is received,
• (i) automatically detecting anomalies indicating deviations from expected or permitted network activities, wherein each anomaly is classified by type and is associated with an entity or entities that participated in network activities and a date at which the detected anomaly occurred, and
• (ii) automatically detecting threats based upon at least one of a number, type, or timing of detected anomalies, and generating a listing of detected threats as pending threats against the computer network;
• upon receiving a user-selection of a detected threat, causing display, in a graphical user interface, of an interactive trendline, which indicates changes to the number of the occurrences of anomalies as a function of dates along the trendline to enable a user to visually depict a trend of the occurrences of the anomalies associated with the threat;
• and
• upon receiving a user-selection, via the graphical user interface, to resolve the detected threat as a false positive, deleting the threat from the listing of pending threats.

A non-transitory, computer-readable storage medium storing instructions, an execution of which in a computer system causes the computer system to perform operations comprising:

• receiving event data generated by network activities of entities that interact with a computer network, wherein the event data comprises machine data, and the entities include computer users and/or devices in communication with the network;
• based upon the received event data as it is received,
• (i) automatically detecting anomalies indicating deviations from expected or permitted network activities, wherein each anomaly is classified by type and is associated with an entity or entities that participated in network activities and a date at which the detected anomaly occurred, and
• (ii) automatically detecting threats based upon at least one of a number, type, or timing of detected anomalies, and generating a listing of detected threats as pending threats against the computer network;
• upon receiving a user-selection of a detected threat, causing display, in a graphical user interface, of an interactive trendline, which indicates changes to the number of the occurrences of anomalies as a function of dates along the trendline to enable a user to visually depict a trend of the occurrences of the anomalies associated with the threat;
• and
• upon receiving a user-selection, via the graphical user interface, to resolve the detected threat as a false positive, deleting the threat from the listing of pending threats.

A computer system comprising:

• computer memory for storing machine data;
• and
• a processor for:
• receiving event data generated by network activities of entities that interact with a computer network, wherein the event data comprises machine data, and the entities include computer users and/or devices in communication with the network;
• based upon the received event data as it is received,
• (i) automatically detecting anomalies indicating deviations from expected or permitted network activities, wherein each anomaly is classified by type and is associated with an entity or entities that participated in network activities and a date at which the detected anomaly occurred, and
• (ii) automatically detecting threats based upon at least one of a number, type, or timing of detected anomalies, and generating a listing of detected threats as pending threats against the computer network;
• upon receiving a user-selection of a detected threat, causing display, in a graphical user interface, of an interactive trendline, which indicates changes to the number of the occurrences of anomalies as a function of dates along the trendline to enable a user to visually depict a trend of the occurrences of the anomalies associated with the threat;
• and
• upon receiving a user-selection, via the graphical user interface, to resolve the detected threat as a false positive, deleting the threat from the listing of pending threats.