Techniques for analyzing data from multiple sources

A non-transitory computer-readable storage medium having stored thereon instructions for causing at least one computer system to detect policy violations for an organization, the instructions comprising:

• instructions that cause the at least one computer system to receive external information from one or more external information sources;
• instructions that cause the at least one computer system to specify the one or more parameters for identifying the external information;
• instructions that cause the at least one computer system to measure a rate of receipt of the received external information, the rate of receipt indicative of a particular amount of the external information being received from the one or more external information sources;
• instructions that cause the at least one computer system to adjust at least one of the one or more parameters to modify the rate of the received external information when the rate deviates from a range of acceptable values;
• instructions that cause the at least one computer system to receive internal information from one or more internal information sources;
• instructions that cause the at least one computer system to store the external information and internal information in one or more data stores that collectively implement one or more ontologies;
• instructions that cause the at least one computer system to apply one or more logical conditions to the external information and internal information in the one or more data stores;
• instructions that cause the at least one computer system to determine a conclusion based on application of the one or more logical conditions, the determined conclusion including at least one detected policy violation;
• and
• instructions that cause the at least one computer system to provide the conclusion.

A system for detecting policy violations for an organization, comprising:

• one or more communications devices collectively operable to receive external information from one or more external information sources and internal information from one or more internal information sources;
• a data store that receives at least a portion of the internal information and at least a portion of the external information, that transforms said at least a portion of the internal information and said at least a portion of the external information to a common schema that implements an ontology;
• and
• one or more computing devices comprising at least one processor configured to execute computer executable instructions to collectively at least:
• specify one or more parameters for identifying the external information;
• measure a rate of receipt of the received external information, the rate of receipt indicative of a particular amount of the external information being received from the one or more external information sources;
• adjust at least one of the one or more parameters to modify the rate of the received external information when the rate deviates from a range of acceptable values;
• cause the one or more communications devices to receive the external information according to the adjusted parameters;
• apply one or more logical conditions to contents of the data store, the contents including said at least a portion of the internal information and said at least a portion of the external information;
• determine a conclusion based on application of the one or more logical conditions, the determined conclusion including at least one detected policy violation;
• and
• provide the conclusion.