Storage and Structured Search of Historical Security Data

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising.
• receiving an event over a network obtained by a plurality of disparate computing resources in communication with the data processing hardware, the event comprising an ingestion-attribute associated with the event;
• determining whether the ingestion-attribute associated with the event satisfies ingestion criteria;
• when the ingestion-attribute associated with the event fails to satisfy the ingestion criteria, discarding the event obtained by the one of the plurality of disparate computing resources;
• when the ingestion-attribute associated with the event satisfies the ingestion criteria, ingesting the event obtained by the one of the plurality of disparate computing resources for persistent storage in a data store;
• determining whether the event has been stored in the data store for a period of time that satisfies an eviction time period threshold;
• and
• when the event has been stored in the data store for the period of time that satisfies the eviction time period threshold, evicting the event from the data store.