Abstract: A method includes receiving, from a plurality of sources, data associated with a plurality of events at the plurality of sources, standardizing the data based on a set of predefined standardization rules to define standardized data, and defining a vector representation for each event from the plurality of events based on the standardized data. The method includes assigning each event from the plurality of events to at least one cohort from a plurality of cohorts based on a similarity associated with the vector representation for that event and each cohort from the plurality of cohorts, generating, using at least one machine learning model, an ontology based on a set of cohorts from the plurality of cohorts and associated with the plurality of events, and storing the plurality of events as associated with the ontology such that the plurality of events can be filtered based on the ontology.

Abstract: A method includes receiving, from a source from a plurality of sources, data associated with an event at the source. The data includes an event timestamp and an event data-frame. The method includes defining a standardized event based on the event by parsing the data to map predefined data fields within the event data-frame based on predefined standardization rules, calculating a representative identifier for the event by providing a representation of the standardized event as an input to a predefined function, defining an identifier for the event based on the representative identifier, calculating a distance of the identifier to an identifier associated with each event cohort from a plurality of event cohorts, assigning the event to an event cohort from the plurality of event cohorts based on the distance meeting a criterion of that cohort, and identifying an anomalous event based on the distance exceeding a predetermined threshold.

Abstract: A method includes receiving, from a source from a plurality of sources, data associated with an event at the source. The data includes an event timestamp and an event data-frame. The method includes defining a standardized event based on the event by parsing the data to map predefined data fields within the event data-frame based on predefined standardization rules, calculating a representative identifier for the event by providing a representation of the standardized event as an input to a predefined function, defining an identifier for the event based on the representative identifier, calculating a distance of the identifier to an identifier associated with each event cohort from a plurality of event cohorts, assigning the event to an event cohort from the plurality of event cohorts based on the distance meeting a criterion of that cohort, and identifying an anomalous event based on the distance exceeding a predetermined threshold.