Abstract: Efficient context-based event log enrichment is disclosed, including: extracting a set of values and corresponding contexts from a plurality of event logs; sending respective enrichment requests that each includes the set of values to a set of enrichment target servers; receiving respective enrichment responses from at least a portion of the set of enrichment target servers; and inserting at least a portion of the respective enrichment responses into a portion of the plurality of event logs based at least in part on the corresponding contexts of the set of values.

Abstract: Detection of unknown applications is disclosed, including: detecting an event associated with accessing an application; determining target information associated with the event; and identifying the application from the target information.

Abstract: Event stream-based threat detection is disclosed, including: determining that an event from a stream of events is an influencing event by comparing the event to an alert rule; storing a new cache entry associated with the influencing event in a detection cache, wherein the new cache entry includes a fingerprint associated with the influencing event; querying the detection cache using at least the fingerprint associated with the new cache entry for a set of related cache entries; and determining whether to generate an alert based at least in part on the set of related cache entries and the alert rule.

Abstract: Event stream-based threat detection is disclosed, including: determining that an event from a stream of events is an influencing event by comparing the event to an alert rule; storing a new cache entry associated with the influencing event in a detection cache, wherein the new cache entry includes a fingerprint associated with the influencing event; querying the detection cache using at least the fingerprint associated with the new cache entry for a set of related cache entries; and determining whether to generate an alert based at least in part on the set of related cache entries and the alert rule.

Abstract: Detection of unknown applications is disclosed, including: detecting an event associated with accessing an application; determining target information associated with the event; and identifying the application from the target information.

Abstract: Detection of unknown applications is disclosed, including: detecting an event associated with accessing an application; determining target information associated with the event; and identifying the application from the target information.

Abstract: Detection of unknown applications is disclosed, including: detecting an event associated with accessing an application; determining target information associated with the event; and identifying the application from the target information.

Abstract: Event stream-based threat detection is disclosed, including: determining that an event from a stream of events is an influencing event by comparing the event to an alert rule; storing a new cache entry associated with the influencing event in a detection cache, wherein the new cache entry includes a fingerprint associated with the influencing event; querying the detection cache using at least the fingerprint associated with the new cache entry for a set of related cache entries; and determining whether to generate an alert based at least in part on the set of related cache entries and the alert rule.