Pattern creation based on an attack path

A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

• identifying, from a normalized log persistency layer, a first Event, wherein the first Event is associated with an attack on a computing system;
• fetching, from the normalized log persistency layer, a plurality of Events, wherein each fetched Event correlates with its neighboring fetched Event by a at least one correlation attribute;
• and presenting each of the fetched Event and the first Event on a graphical user interface as a chain of events;
• generating a workspace, wherein the workspace comprises a series of attack paths, wherein each attack path corresponds to one Event in the chain of events;
• and
• creating an enterprise threat detection (ETD) pattern based on the attack paths in the workspace.

A computer-implemented system, comprising:

• one or more computers;
• and
• one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
• identifying, from a normalized log persistency layer, a first Event, wherein the first Event is associated with an attack on a computing system;
• fetching, from the normalized log persistency layer, a plurality of Events, wherein each fetched Event correlates with its neighboring fetched Event by a at least one correlation attribute;
• and presenting each of the fetched Event and the first Event on a graphical user interface as a chain of events;
• generating a workspace, wherein the workspace comprises a series of attack paths, wherein each attack path corresponds to one Event in the chain of events;
• and
• creating an enterprise threat detection (ETD) pattern based on the attack paths in the workspace.