Abstract: A system for processing cybersecurity monitoring data includes a load balancing operator coupled to at least one incoming data stream. The load balancing operator is operable to distribute cybersecurity monitoring messages amongst a plurality of collector processing units operable to generate monitoring records from the received cybersecurity monitoring messages in a first format. A plurality of parser sub-units coupled to the plurality of collector processing sub-units are operable to generate parsed monitoring records by converting the received monitoring records from the first format to a second format. A combiner operator coupled to the plurality of parser sub-units is operable to combine the parsed monitoring records from the plurality of parser sub-units into a synchronous output data stream. The system is configured such that data flows sequentially from the load balancing operator to the plurality of collector processing sub-units and to the plurality of parser sub-units to the combiner operator.

Abstract: A system for processing network flow monitoring data includes a data collection input coupled to at least one incoming data stream; a load balancing operator is operable to distribute the network monitoring messages amongst a plurality of downstream processing units; a plurality of collector processing sub-units downstream from the load balancing operator are operable to generate network flow records from the received network monitoring messages in a first format; a plurality of parser sub-units coupled to the plurality of collector processing sub-units are operable to generate parsed network flow records by converting the received network flow records from the first format to a second format; and a combiner operator coupled to the plurality of parser sub-units is operable to combine the parsed network flow records from the plurality of parser sub-units into a synchronous output data stream.