Method and system for generating an entities view with risk-level scoring for performing computer security monitoring

A computerized method comprising:

• receiving event data associated with network activities entities that interact with a computer network;
• identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and anomalies, the identified instances are associated with entities that participated in the network activities from which the instances were determined, and each threat is an automated determination based on one or more of the anomalies;
• automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and/or type of identified instances of potential network compromise associated with the entity;
• and
• causing display, in a graphical user interface, of an indication of a determined score, wherein:
• the graphical user interface selectively provides a view identifying entities that participated in network activities that triggered determinations of potential network compromise, and
• each entity listed in the view includes the associated score.

A non-transitory, computer-readable storage medium storing instructions, an execution of which in a computer system causes the computer system to perform operations comprising:

• A computerized method comprising:
• receiving event data associated with network activities entities that interact with a computer network;
• identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and anomalies, the identified instances are associated with entities that participated in the network activities from which the instances were determined, and each threat is an automated determination based on one or more of the anomalies;
• automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and/or type of identified instances of potential network compromise associated with the entity;
• and
• causing display, in a graphical user interface, of an indication of a determined score, wherein:
• the graphical user interface selectively provides a view identifying entities that participated in network activities that triggered determinations of potential network compromise, and
• each entity listed in the view includes the associated score.

A computer system comprising:

• computer memory for storing machine data;
• and
• a processor for:
• receiving event data associated with network activities entities that interact with a computer network;
• identifying instances of potential network compromise automatically determined from the event data, wherein instances include threats and anomalies, the identified instances are associated with entities that participated in the network activities from which the instances were determined, and each threat is an automated determination based on one or more of the anomalies;
• automatically determining a score for each entity, wherein the score indicates a risk level based at least in part on the number and/or type of identified instances of potential network compromise associated with the entity;
• and
• causing display, in a graphical user interface, of an indication of a determined score, wherein:
• the graphical user interface selectively provides a view identifying entities that participated in network activities that triggered determinations of potential network compromise, and
• each entity listed in the view includes the associated score.