Abstract: Provided herein are systems and methods of investigating an entity or a potential incident. A tracker engine may receive an identification of a first entity in a networked environment. The tracker engine may display, in a user interface responsive to receiving the identification, a representation of the first entity, and representations of a plurality of entities associated with the first entity. The plurality of associated entities may include: a network connection, a file, a process, a user or a computing device. The tracker engine may receive, via the user interface, a selection of a second entity from the plurality of associated entities. The tracker engine may update, responsive to receiving the selection, the user interface to display a representation of the second entity graphically linked to the representation of the first entity, and representations of a plurality of entities associated with the second entity.

Abstract: Provided herein are systems and methods of tracing data. A tracing engine may receive, via the user interface, a selection of a target file or an event involving the target file. The tracing engine may generate, responsive to receiving the selection, a trace of first data in the target file to a plurality of file instances in a network each having at least one version of the first data. Each of the plurality of file instances may be related to at least the target file or another of the plurality of file instances via at least one file operation or data operation. The tracing engine may render, via a user interface, the generated trace.

Abstract: Provided herein are systems and methods of tracing data. A tracing engine may receive, via the user interface, a selection of a target file or an event involving the target file. The tracing engine may generate, responsive to receiving the selection, a trace of first data in the target file to a plurality of file instances in a network each having at least one version of the first data. Each of the plurality of file instances may be related to at least the target file or another of the plurality of file instances via at least one file operation or data operation. The tracing engine may render, via a user interface, the generated trace.

Abstract: Provided herein are systems and methods of investigating an entity or a potential incident. A tracker engine may receive an identification of a first entity in a networked environment. The tracker engine may display, in a user interface responsive to receiving the identification, a representation of the first entity, and representations of a plurality of entities associated with the first entity. The plurality of associated entities may include: a network connection, a file, a process, a user or a computing device. The tracker engine may receive, via the user interface, a selection of a second entity from the plurality of associated entities. The tracker engine may update, responsive to receiving the selection, the user interface to display a representation of the second entity graphically linked to the representation of the first entity, and representations of a plurality of entities associated with the second entity.