Abstract: Exemplary systems and methods are directed to risk-based observability of a platform. Data is received from plural devices from one or more computing environments on a network. The received data is in a raw data format according to the computing environment or platform from which it was received. The received data is converted from the raw format to a structured format. The converted data is enhanced by adding contextual information associated with a corresponding one of the plural devices. A risk analysis is performed on the enhanced data based on one or more risk detection rules applied to the network. One or more tags are applied to the enhanced data based on results of the risk analysis. Data analysis is performed on the enhanced data to identify devices from aggregate sources. The data is sent to one or more destinations on the network based on the applied tags.

Abstract: Disclosed is a system for processing data streams that includes a parallel processor and a netflow aggregator module to generate a storage representation for data packets. Each storage representation includes segments of information about the data packet, the segments of information including information about a communication protocol specification related to the data packet. The netflow aggregator module generates a composite index to identify a data packet association characteristic for each data packet and stores the composite index in a segment of the storage representation. The netflow aggregator module groups data packets by their composite index. The netflow aggregator module generates a session flow identifier by identifying a beginning and/or end of a transmission netflow for each data packet having the same data packet association characteristic. The netflow aggregator module aggregates and orders the data packets having the same session flow identifiers into a flow channel.