Investigative and dynamic detection of potential security-threat indicators from events in big data

A system, comprising:

• a subsystem, implemented at least partially in hardware, that organizes raw machine data collected from one or more remote hardware devices, wherein the collected raw machine data relates to operations or activities in an information technology environment, wherein the one or more computing devices is configured to collect the raw machine data as a plurality of data types from a plurality of remote hardware devices into a set of searchable, time-stamped events;
• a subsystem, implemented at least partially in hardware, that stores the set of events in a data store stored in computer memory, wherein each event in the set of events is searchable based on its associated time stamp;
• a subsystem, implemented at least partially in hardware, that executes a search to identify a subset of the set of events satisfying search criteria that includes having a time stamp occurring within a specified time period;
• a subsystem, implemented at least partially in hardware, that, while or after identifying the subset of the set of events, applies a schema to the raw machine data included in each event in the subset of the set of events in order to impose structure on the raw machine data and to extract a set of semantically related values
• a subsystem, implemented at least partially in hardware, that calculates a population statistic based on the set of values;
• a subsystem, implemented at least partially in hardware, that receives a criterion for determining whether each value in the set of values is sufficiently different than the population statistic;
• a subsystem, implemented at least partially in hardware, that determines a subset of values in the set of values, wherein each value in the subset of values is identified as an outlier in relation to the population statistic based on application of the criterion to each value in the set of values;
• and
• a subsystem, implemented at least partially in hardware, that causes graphical display of information relating to the subset of values.

A computer-program product comprising a non-transitory machine-readable storage medium with instructions stored thereon, the instructions configured to cause one or more microprocessors to perform:

• organizing raw machine data collected from one or more remote hardware devices, wherein the collected raw machine data relates to operations or activities in an information technology environment, wherein the one or more computing devices is configured to collect the raw machine data as a plurality of data types from a plurality of remote hardware devices into a set of searchable, time-stamped events;
• storing the set of events in a data store stored in computer memory, wherein each event in the set of events is searchable based on its associated time stamp;
• executing a computer-implemented search to identify a subset of the set of events satisfying search criteria that includes having a time stamp occurring within a specified time period;
• while or after identifying the subset of the set of events, applying a schema to the raw machine data included in each event in the subset of the set of events in order to impose structure on the raw machine data and to extract a set of semantically related values;
• calculating a population statistic based on the set of values;
• receiving a criterion for determining whether each value in the set of values is sufficiently different than the population statistic;
• determining a subset of values in the set of values, wherein each value in the subset of values is identified as an outlier in relation to the population statistic based on application of the criterion to each value in the set of values;
• and
• causing graphical display of information relating to the subset of values.