Abstract: Systems and methods include a memory and processing devices configured to perform operations. The operations include obtaining telemetry log data comprising an event log that includes one or more values; parsing, using an event log parser extension, a first portion of the one or more values to insert one or more first key-value pairs into a data object, wherein at least a portion of the one or more first key-value pairs includes a value from the first portion of the one or more values and a key assigned to the value; and performing one or more data analysis operations on the data object.

Abstract: Systems and methods include identifying fields associated with a log event of telemetry data and, for each field, selecting a key from multiple keys and generating a field-key mapping that includes a mapping from the fields to the selected key. The systems and methods generate an event log parser extension that includes the field-key mappings and validate the parser extension by testing its performance on sample log events. The systems and methods then execute a base parser and the validated event log parser extension on event logs to convert the event logs into a standardized format and perform data analytics on the standardized event logs to identify trends in the event logs and identify possible threats.

Abstract: The disclosed computer-implemented method for monitoring bait to protect users from security threats may include (i) monitoring a bait computing resource to detect attempts to access the bait computing resource, (ii) virtualizing the bait computing resource to prevent a false positive by hiding the bait computing resource from at least one trusted application that has been categorized as safe, (iii) detecting an attempt by a different application to access the virtualized bait computing resource, and (iv) performing a security action to protect a trusted user by reporting the attempt to access the virtualized bait computing resource by the different application. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for monitoring bait to protect users from security threats may include (i) monitoring a bait computing resource to detect attempts to access the bait computing resource, (ii) virtualizing the bait computing resource to prevent a false positive by hiding the bait computing resource from at least one trusted application that has been categorized as safe, (iii) detecting an attempt by a different application to access the virtualized bait computing resource, and (iv) performing a security action to protect a trusted user by reporting the attempt to access the virtualized bait computing resource by the different application. Various other methods, systems, and computer-readable media are also disclosed.