Abstract: This disclosure provides a filtering mechanism to manage anomalous security data items. An anomalous security data item is provided to an analysis engine (such as a Large Language Model (LLM) or another form of generative language model) for interpretation. By curating a selection of one or more relevant non-anomalous security data items to provide with the anomalous data item, the filtering mechanism enables the analysis engine to perform with increased accuracy, without requiring the analyst engine to process large numbers of data items to ascertain their relevance to the anomalous security data item.

Abstract: According to examples, an apparatus may include a processor and a memory on which are stored machine-readable instructions that, when executed by the processor, may cause the processor to determine a plurality of queues for storing event data. The processor may partition the event data into a plurality of logical partitions and group the logical partitions into a plurality of logical partition ranges. Each logical partition range may be assigned to a respective queue of the plurality of queues. The processor may determine a first logical partition range mapped to a first queue, compute a first set of metrics for the first queue, and determine a first load of the first queue based on the first set of metrics. The processor may then adjust the first logical partition range by modifying a number of logical partitions mapped to the first queue based on the first load as determined.

Abstract: This disclosure provides a filtering mechanism to manage anomalous security data items. An anomalous security data item is provided to an analysis engine (such as a Large Language Model (LLM) or another form of generative language model) for interpretation. By curating a selection of one or more relevant non-anomalous security data items to provide with the anomalous data item, the filtering mechanism enables the analysis engine to perform with increased accuracy, without requiring the analyst engine to process large numbers of data items to ascertain their relevance to the anomalous security data item.

Abstract: According to examples, an apparatus may include a processor and a memory on which are stored machine-readable instructions that, when executed by the processor, may cause the processor to receive event data to be placed in a plurality of queues. The processor may determine logical partitions for the received event data and may store the event data in the plurality of queues based on the determined logical partitions. A first queue of the plurality of queues may be mapped to a first logical partition range and a second queue of the plurality of queues may be mapped to a second logical partition range. Based on respective loads at the plurality of queues, the processor may update a mapping of the determined logical partitions to the plurality of queues by transferring logical partitions between the first queue and the second queue.

Abstract: According to examples, an apparatus may include a processor and a memory on which are stored machine-readable instructions that, when executed by the processor, may cause the processor to receive event data to be placed in a plurality of queues. The processor may determine logical partitions for the received event data and may store the event data in the plurality of queues based on the determined logical partitions. A first queue of the plurality of queues may be mapped to a first logical partition range and a second queue of the plurality of queues may be mapped to a second logical partition range. Based on respective loads at the plurality of queues, the processor may update a mapping of the determined logical partitions to the plurality of queues by transferring logical partitions between the first queue and the second queue.