Abstract: A computer system is configured to receiving a data set from a data provider and automatically save the data set in a quarantine database where copying, moving, and sharing of the data set are restricted until the data set is released by a data provider. The data set is parsed to find and mark portions with potentially sensitive information. At least those parts are reviewed by a data governor, who can confirm, add, edit, or remove markers. Those parts can be visually indicated to the data governor, along with a preview of, metadata about, and analysis of the data set. After reviewing at least the automatically marked portions, the data governor can release the data set to a non-quarantine database where another user can use the data set. The user is restricted from accessing the quarantine database.

Abstract: A method is disclosed. The method comprises receiving, from one or more search nodes of a distributed system, one or more requests for log data, the one or more search nodes being associated with one or more hot storage systems; identifying, from an index catalog, an indexed portion of the log data stored in a cold storage system of one or more cold storage systems based on at least part of the particular request, the index catalog containing pointers to indexed portions of the log data in the one or more cold storage systems, the indexing being performed by one or more indexing nodes independently from the receiving by the one or more search nodes; and sending the indexed portion to the one or more search nodes for storage in the associated one or more hot storage systems, wherein the method is performed using one or more processors.

Abstract: Systems and methods are provided for determining a query involving at least one dataset comprising a plurality of records, the query being submitted by a first user operating a computing device. An archetype policy that governs access to records of the at least one dataset can be determined, wherein the archetype policy includes at least one logical formula to be evaluated when determining whether a requesting user is permitted to access a given record, and wherein the at least one logical formula is satisfied based at least in part on a state associated with the requesting user and at least one first variable evaluated by the at least one logical formula. At least one record that the first user is permitted to access can be determined based at least in part on satisfaction of the at least one logical formula associated with the archetype policy.

Abstract: A system includes a communications interface configured to receive a plurality of data series captured by a plurality of sensors. A first database includes at least a first data series of the plurality of data series. A second database includes metadata related to the first data series. One or more processors are configured to receive an instruction including an indication of a computation to perform and metadata filter criteria, query the second database to determine at least a portion of the first data series that satisfies the metadata filter criteria by reference to at least the metadata related to the first data series, access, from the first database and based on results of the query of the second database, the portion of the first data series, and perform the computation on the portion of first data series accessed from the first database.

Abstract: Systems, methods, and non-transitory computer readable media are provided for providing a redundancy tool for performing transactions. A transaction to be performed on a data stored in a database may be received. A timestamp may be assigned to the transaction. A lock may be assigned on the timestamp. The transaction may be performed on the data. The lock may be refreshed while performing the transaction on the data. A validity of the lock may be checked at after performing the transaction on the data. Responsive to the lock being valid, a result of performing the transaction on the data may be committed.

Abstract: A security system detects and attributes anomalous activity in a network. The system logs user network activity, which can include ports used, IP addresses, commands typed, etc., and may detect anomalous activity by comparing users to find similar users, sorting similar users into cohorts, and comparing new user activity to logged behavior of the cohort. The comparison can include a divergence calculation. Origins of user activity can also be used to determine anomalous network activity. The hostname, username, IP address, and timestamp can be used to calculate aggregate scores and convoluted scores. The system extracts features from the logged anomalous network activity, and determines whether the activity is attributable to an actor profile by comparing the extracted features and attributes associated with the actor profile based upon previous activity attributed to the actor.

Abstract: Systems and methods are provided in order to avoid ingesting the entire contents of one or more data sources. An object may be associated with one or more pieces/fragments of data that can be stored in different data sources. When a request for the object is initiated, a search for those pieces/fragments of data can be performed. Nodes associated with each data source may generate data queries appropriate for its corresponding data source, retrieve, and if needed transform the data into an object-based data structure. Any pieces/fragments of data that have been discovered and retrieved can be joined, e.g., by an application programming interface server, and forwarded to a requesting client or application. In this way, only data relevant to the object is obtained. Moreover, object versioning can be employed so that the most up-to-date data is obtained.

Abstract: Techniques for generating a schema for a data input file are described herein. In an embodiment, a server computer receives a data input file. The server computer system selects a sample excerpt from the data input which comprises a subset of the data input file. The server computer system analyzes the sample excerpt to determine a row delimiter for the data input file, a column delimiter for the data input file, and a plurality of data format types. Using the column delimiter, row delimiter, and plurality of data format types, the server computer system generates a candidate schema for the data input file.

Abstract: Systems and methods are disclosed for collaborative information analysis via electronic communications. In accordance with one implementation, a method is provided for analyzing electronic communications. The method includes, for example, receiving a selection of one of a plurality of electronic communication systems. Moreover, the method includes receiving, from the selected electronic communication system, an electronic communication comprising a plurality of terms and identifying at least one term of interest from the plurality of terms. The method further includes searching for information pertaining to the at least one term of interest and receiving information responsive to the search. The method also includes creating an object corresponding to the at least one term of interest and sharing a representation of the object with one or more users.

Abstract: Systems and methods are provided for master-to-master OT-based artifact peering. A “master-to-master” architecture for artifacts is implemented in a network comprising a plurality of nodes and clients, where no node is designated a “master” or “primary” for a given artifact. A first node receives a subset of remote proposed operations from a second node and determines if a conflict exists between the received subset of remote proposed operations and at least one of a plurality of locally-proposed operations. The first node resolves the conflict based on a total-ordering agreed upon between the first node and the second node. The first node transforms at least one operation, either received or locally-proposed, based on the resolved conflict. The first node than updates a local log to include the transformed operation.

Abstract: A model management system provides a centralized repository for storing and accessing models. The model management system receives an input to store a model object in a first model state generated based on a first set of known variables. The model management system generates a first file including a first set of functions defining the first model state and associates the first file with a model key identifying the model object. The model management system receives an input to store the model object in a second model state having been generated based on the first model state and a second set of known variables. The model management system generates a second file including a second set of functions defining the second model state and associates the second file with the model key. The model management system identifies available versions of the model object based on the model key.

Abstract: Systems and methods are provided for determining a set of objects, the objects corresponding to a given case or application of a deletion/retention policy; determining at least one object in the set of objects to be scheduled for deletion, the at least one object being associated with a given state that specifies a deletion and/or retention type and schedule for the at least one object; and scheduling data corresponding to the at least one object for deletion from one or more data sources based at least in part on the deletion and/or retention type and schedule specified in the object state.

Abstract: Systems and methods are provided for enhanced alert generation based on real-time manipulation of datasets. An example method includes accessing datasets including a plurality of rows each indicating a plurality of values. Occurrences of alert definitions are monitored via applying the alert definitions to the datasets, the alert definitions specifying expressions utilizing one or more of the values, with an occurrence of an alert definition indicating satisfaction of the specified expression and causing an associated alert to be generated for evaluation. Presentation of an interactive user interface associated with customizing alert definitions is caused. The interactive user interface presents a first visual portion, the first visual portion enabling specification of an expression for a customized alert definition.

Abstract: The systems and methods described herein provide highly dynamic and interactive data analysis user interfaces which enable the data analyst to quickly and efficiently explore large volume data sources, such as computer code or intellectual system. A user interface can be implanted that includes a plurality of nodes associated with portions of a process. The nodes may include indications of logical relationships between nodes. Node identifiers may be associated with particular nodes and be usable to select particular nodes. Reliability scores associated with particular nodes can be included.

Abstract: Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, and provide results of the automated analysis in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a compact, human-readable analysis of the data clusters. The human-readable analyses (also referred to herein as “summaries” or “conclusions”) of the data clusters may be organized into an interactive user interface so as to enable an analyst to quickly navigate among information associated with various data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation. Embodiments of the present disclosure also relate to automated scoring of the clustered data structures.

Abstract: Disclosed are data gathering and analysis systems, methods, and computer-readable storage media to facilitate an investigation process. The method includes accessing a data object representing an investigative issue as part of initiating an investigative session. The method further includes causing presentation, on a display of a device, of a user interface configured to receive user search queries and present search results for each received search query. The method further includes tracking user activity including one or more user actions performed during the investigative session. The method further includes creating a record of the user activity, and linking the record of the user activity with the data object representing the investigative issue.

Abstract: A method, computer program and apparatus is disclosed. The method, performed by one or more processors, may comprise receiving, from one or more predetermined organizations, datasets representing entities and datasets representing one or more tasks for those entities and storing in a database, in accordance with an ontology which is common to the organizations, the received one or more datasets as data objects, the ontology defining properties of data objects and relationships between the data objects. The method may also comprise mapping the data objects stored in the database to the organization from which the one or more datasets were received and receiving, through a querying application, a query from a user of one of the predetermined organizations to view one or more data objects relating to a task.

Abstract: Systems and methods for video georegistration are provided. An example method includes: receiving an input image; generating a plurality of templates from the input image; and generating a template queue based at least in part on the plurality of template scores. The plurality of templates are associated with a plurality of template scores. The template queue includes a set of selected templates. The method further includes receiving one or more reference images; determining a set of match scores for the set of selected templates by applying a matching algorithm to the set of selected templates and at least one reference image of the one or more reference images; evaluating the set of match scores to select a collection of templates, and generating an image transform based at least in part on the collection of templates. Each template of the collection of templates meets one or more selection criteria.

Abstract: Described herein are systems, methods, and non-transitory computer readable media for defining and executing functions for determining a matching entity that is relevant to an entity of interest when, for example, there is a significant number of intermediary links and entities between the matching entity and the entity of interest. A visual depiction of a path traversal from a seed input entity to an output matched entity can be presented to an end user in a manner that allows the end user to ascertain the sequence of intermediary links and entities that connect the matched entity to the seed entity.

Abstract: Systems and methods are provided for improved interactive graphical user interfaces. The system allows users to visually construct queries of a database. The system can dynamically generate visual representations of supplemental data and cumulative data. Users can share annotations related to user input queries via the graphical user interface.