Abstract: Methods and systems for computing a risk metric on a network of processing nodes are disclosed. The method includes receiving a plurality of events at a plurality of processing nodes. The method further includes at a first processing node, processing on a first event and a known instance of a second event to determine whether the first event matches the known instance of the second event. The method further includes in response to determining that the first event does not match the known instance of the second event, terminating the processing without generating an output, and generating a first output event having a resulting probability computed based on a confidence value of the first event and a first probabilistic value of a first missing event, or in response to determining that the first event matches the known instance of the second event, generating the first output event having the resulting probability computed based on the confidence value of the first event.

Abstract: Systems and methods for processing events are disclosed. Event data comprising passive event data, active event data, or both is received. It is determined whether the received event data is available for a pattern of passive event data and active event data. In response to determining that the received event data is available for the pattern of passive event data and active event data, one or more constraints between the passive event data and the active event data are converted into one or more query terms. The query terms are used to construct at least one query. Remaining passive event data that is related to some, but not all, of the active event data is obtained using the constructed at least one query.

Abstract: Methods and systems for processing events are disclosed. According to one embodiment, input source data that includes event data of one or more events is received. One or more event definitions that match the event data are selected. For each matching event definition, the event definition is inputted into a template to generate a set of events. The template includes a number of assertions and has the event definition as one of the assertions, where each assertion includes a constraint. The constraints of the assertions are progressively processed to produce one or more solutions that are subsets of the set of events. For each constraint and each solution, a set of target events that is viable for the solution is identified, and a new solution is produced based on the solution and the identified set of target events, whereby a set of new solutions is produced.

Abstract: The present invention is a method or system of analyzing items to create a data structure using lexicon analysis and filtering process. The present invention drives the analysis without a user being required to provide search terms and Boolean queries. Further, the present invention merges the use of unstructured data and structured data using a lexicon as a focus. Structured data is mapped to lexicon terms through one analysis process, while unstructured data is mapped to lexicon terms through a separate analysis process. In some disclosed embodiments, the mapping process uses a tuple structure of the source data to match with lexicon terms. The result is an analysis that merges the two different sets of data, which enables a user to navigate through the items using lexicons. Analysis results are displayed simultaneously in a tabular view, geospatial view, and lexicon histogram.