Automatic triaging of network events

A system for automatic classification of a network event, the system comprising:

• a processor;
• a non-transitory computer-readable medium;
• and
• instructions stored on the non-transitory computer-readable medium and translatable by the processor for:
• collecting network event data comprising:
• afflicting content of the network event representative of a user activity violating a policy;
• and
• non-afflicting content comprising metadata associated with the network event but not directly indicative of a policy violation;
• hashing at least a portion of the non-afflicting content so as to generate a hash value of the non-afflicting content;
• generating a network event profile for the network event, the network event profile including (i) the hash value and (ii) one or more attributes representative of the network event;
• and
• obtaining, via a prediction model, a classification based on the network event profile, the classification based on whether the network event profile matches any reference profile associated with network events, the reference profile including a reference hash value and one or more reference attributes representative of the network event.

A computer program product for automatic classification of a network event, the computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor for:

• collecting network event data comprising:
• afflicting content of the network event representative of a user activity violating a policy;
• and
• non-afflicting content comprising metadata associated with the network event but not directly indicative of a policy violation;
• hashing at least a portion of the non-afflicting content so as to generate a hash value of the non-afflicting content;
• generating a network event profile for the network event, the network event profile including (i) the hash value and (ii) one or more attributes representative of the network event;
• and
• obtaining, via a prediction model, a classification based on the network event profile, the classification based on whether the network event profile matches any reference profile associated with network events, the reference profile including a reference hash value and one or more reference attributes representative of the network event.