Executing playbooks against aggregate notable events in an information technology and security operations application

An application security platform comprising:

• one or more computing nodes, each with a processor and a memory, wherein the data intake and query system is operable to execute instructions stored in the memory, which instructions cause the computing nodes within the system to perform operations including:
• obtaining a plurality of events reflecting real-time activity in an IT environment;
• identifying, from the plurality of events, a set of related events indicative of an in-progress security incident using a machine learning (ML) technique;
• generating an aggregate notable event rule for identifying the set of related events, wherein the rule is based on commonalities identified by the ML technique;
• using the aggregate notable event rule to detect an aggregate notable event when the criteria of the aggregate notable event rule are met;
• and
• using the detected aggregate notable event to generate an alert.

A non-transitory computer-readable media including instructions, which when executed by a hybrid security platform including one or more computing nodes, each with a processor and a memory, wherein the data intake and query system is operable to execute instructions stored in the memory, which instructions cause the computing nodes within the system to perform operations including:

• obtaining a plurality of events reflecting real-time activity in an IT environment;
• identifying, from the plurality of events, a set of related events indicative of an in-progress security incident using a machine learning (ML) technique;
• generating an aggregate notable event rule for identifying the set of related events, wherein the rule is based on commonalities identified by the ML technique;
• using the aggregate notable event rule to detect an aggregate notable event when the criteria of the aggregate notable event rule are met;
• and
• using the detected aggregate notable event to generate an alert.