Abstract: A static information pipeline is configured to generate formatted static data recording information about malware generated during static analyses of malware. A dynamic information pipeline is configured to generate formatted dynamic data recording information about malware generated during dynamic analyses of malware performed within a network to be protected by the system. A datastore is configured to receive and store the formatted static data; receive and store the formatted dynamic data; generate indices that link stored formatted static data and stored formatted dynamic data that share similar properties; and respond to queries using the indices.

Abstract: One or more malware data pipelines is configured to provide malware data that includes original data fields identifying information for detected malware instances and corresponding files that are associated with the detected malware instances. Malware enrichment circuitry is configured to identify additional information to include in enriched data fields for the detected malware instances, the additional information being identified from one or more of: the original data fields, the corresponding files, and one or more third party services. A datastore is configured to store the malware data with the original data fields and the enriched data fields, wherein the datastore includes indices for both the original data fields and the enriched data fields to permit for searching and analysis across the original data fields and the enriched data fields.

Abstract: User interfaces are generated by operations that include receive and store formatted static data and dynamic data. A first query is received, and first response data is selected. A user interface is generated containing the first response data and the user interface is displayed. An indication of user selection is received. A second query is generated and second response data is selected. The user interface is updated to a second user interface, which is displayed.