Abstract: Example techniques herein filter and classify security-relevant events from monitored computing devices. A control unit can receive event records of various types, each event record associated with a monitored device. The control unit can provide, for each event record matching a corresponding pattern of a pattern set associated with the respective event type, a respective match record. Each match record can include an identifier of the corresponding pattern and data of the respective event record. The control unit can provide, for each match record satisfying a corresponding condition of a condition set, a respective candidate record including a tag associated with the corresponding condition. The control unit can provide, for each candidate record satisfying a tag criterion, a result record. Some examples can receive a modification record and use it to provide an updated condition set used for determining candidate records.

Abstract: Cardinality-based activity pattern detection is described herein. Events on a computing system are monitored to detect patterns matching defined activity patterns. A cardinality-based activity pattern query is executed over data representing detected activity patterns to identify multiple, distinct defined activity patterns that have occurred during a particular time period.

Abstract: Example techniques herein filter and classify security-relevant events from monitored computing devices. A control unit can receive event records of various types, each event record associated with a monitored device. The control unit can provide, for each event record matching a corresponding pattern of a pattern set associated with the respective event type, a respective match record. Each match record can include an identifier of the corresponding pattern and data of the respective event record. The control unit can provide, for each match record satisfying a corresponding condition of a condition set, a respective candidate record including a tag associated with the corresponding condition. The control unit can provide, for each candidate record satisfying a tag criterion, a result record. Some examples can receive a modification record and use it to provide an updated condition set used for determining candidate records.

Abstract: Cardinality-based activity pattern detection is described herein. Events on a computing system are monitored to detect patterns matching defined activity patterns. A cardinality-based activity pattern query is executed over data representing detected activity patterns to identify multiple, distinct defined activity patterns that have occurred during a particular time period.

Abstract: Methods and arrangements for developing knowledge bases from social media. A question is obtained from social media. Social media are consulted, and a legitimacy of the question is ascertained. All the answers to the question are harvested from the social media including the rich media that is associated with these answers, and the question is filtered out if determined not to be legitimate.

Abstract: Methods and arrangements for developing knowledge bases from social media. A question is obtained from social media. Social media are consulted, and a legitimacy of the question is ascertained. All the answers to the question are harvested from the social media including the rich media that is associated with these answers, and the question is filtered out if determined not to be legitimate.

Abstract: Methods and arrangements for developing knowledge bases from social media. A question is obtained from social media. Social media are consulted, and a legitimacy of the question is ascertained. All the answers to the question are harvested from the social media including the rich media that is associated with these answers, and the question is filtered out if determined not to be legitimate.

Abstract: Methods and arrangements for developing knowledge bases from social media. A question is obtained from social media. Social media are consulted, and a legitimacy of the question is ascertained. All the answers to the question are harvested from the social media including the rich media that is associated with these answers, and the question is filtered out if determined not to be legitimate.