Abstract: A method includes ingesting event data over a network for a plurality of events obtained by disparate computing resources. Each event is associated with a respective timestamp and one or more ingestion-attributes. The method includes identifying whether the corresponding event is associated with any custom indexing-attributes defined by a user. The method also includes indexing the corresponding event into a data store as structured data based on the respective timestamp, the one or more ingestion-attributes, and any identified custom indexing-attributes. The method includes evicting any of the events of the event data in the data store for a period of time that satisfies an eviction time period threshold. The method also includes retrieving the data from the data store that is associated with the time range, the ingestion-attributes, or the one custom indexing-attributes.

Abstract: A method includes ingesting event data over a network for a plurality of events obtained by disparate computing resources. Each event is associated with a respective timestamp and one or more ingestion-attributes. The method includes identifying whether the corresponding event is associated with any custom indexing-attributes defined by a user. The method also includes indexing the corresponding event into a data store as structured data based on the respective timestamp, the one or more ingestion-attributes, and any identified custom indexing-attributes. The method includes evicting any of the events of the event data in the data store for a period of time that satisfies an eviction time period threshold. The method also includes retrieving the data from the data store that is associated with the time range, the ingestion-attributes, or the one custom indexing-attributes.

Abstract: An anti-abuse system is provided for a data-platform. An anti-abuse scanner of the data-platform detects a creation of an application package by a provider of content to the data platform where the application package includes a set of files for deployment on the data platform. The anti-abuse scanner performs a review o the set of files to detect malicious content where the review is based on a set of analysis rules and generates a deployment decision for the application package based on a result of the review.

Abstract: A system for providing real-time automated security scoring for a data platform. The system collects application log data and threat intelligence data in a variety of formats and normalizes the application log data and threat intelligence data. A risk scoring engine uses the normalized application log data, the normalized threat intelligence data, and a risk mapping matrix to generate security score data. Security risk assessment data including the security score data is stored in a shared database so that consumers of the security scoring data can access the security risk assessment data in real-time.

Abstract: An anti-abuse system is provided for a data-platform. An anti-abuse scanner of the data-platform detects a creation of an application package by a provider of content to the data platform where the application package includes a set of files for deployment on the data platform. The anti-abuse scanner performs a review o the set of files to detect malicious content where the review is based on a set of analysis rules and generates a deployment decision for the application package based on a result of the review.

Abstract: An anti-abuse system is provided for a data-platform. An anti-abuse scanner of the data-platform detects a creation of an application package by a provider of content to the data platform where the application package includes a set of files for deployment on the data platform. The anti-abuse scanner performs a review of the set of files to detect malicious content where the review is based on a set of analysis rules and generates a deployment decision for the application package based on a result of the review.

Abstract: A method includes ingesting event data over a network for a plurality of events obtained by disparate computing resources. Each event is associated with a respective timestamp and one or more ingestion-attributes. The method includes identifying whether the corresponding event is associated with any custom indexing-attributes defined by a user. The method also includes indexing the corresponding event into a data store as structured data based on the respective timestamp, the one or more ingestion-attributes, and any identified custom indexing-attributes. The method includes evicting any of the events of the event data in the data store for a period of time that satisfies an eviction time period threshold. The method also includes retrieving the data from the data store that is associated with the time range, the ingestion-attributes, or the one custom indexing-attributes.

Abstract: A method includes ingesting event data over a network for a plurality of events obtained by disparate computing resources. Each event is associated with a respective timestamp and one or more ingestion-attributes. The method includes identifying whether the corresponding event is associated with any custom indexing-attributes defined by a user. The method also includes indexing the corresponding event into a data store as structured data based on the respective timestamp, the one or more ingestion-attributes, and any identified custom indexing-attributes. The method includes evicting any of the events of the event data in the data store for a period of time that satisfies an eviction time period threshold. The method also includes retrieving the data from the data store that is associated with the time range, the ingestion-attributes, or the one custom indexing-attributes.

Abstract: A method includes ingesting event data over a network for a plurality of events obtained by disparate computing resources. Each event is associated with a respective timestamp and one or more ingestion-attributes. The method includes identifying whether the corresponding event is associated with any custom indexing-attributes defined by a user. The method also includes indexing the corresponding event into a data store as structured data based on the respective timestamp, the one or more ingestion-attributes, and any identified custom indexing-attributes. The method includes evicting any of the events of the event data in the data store for a period of time that satisfies an eviction time period threshold. The method also includes retrieving the data from the data store that is associated with the time range, the ingestion-attributes, or the one custom indexing-attributes.