Abstract: A query is converted into a structured query tokenization. One or more query results visualizations for the query are determined by applying a supervised machine learning model to the structured query tokenization into which the query has been converted. Query results of the query are displayed using the determined query results visualizations.

Abstract: This document describes techniques and apparatuses for enhancing data-analytic visualizations of a data analytics system. A computing device captures input data and output data associated with a data-analytic visualization generated by an advanced user using the data analytics system. The input data and output data are mapped together for defining the data-analytic visualization generated. A machine learning model is trained relative to the mapped input data and output data for generating the data-analytic visualization. During a normal usage of the data analytics system by a user, the trained model generates data-analytic visualizations to suggest to the user responsive to input data from the user. An optional threshold is set and applied relative to the data-analytic visualizations generated. If a data-analytic visualization meets the threshold, the data analytics system reports the data-analytic visualization.

Abstract: A method includes applying, by a computer, supervised machine learning to classify a network device that is associated with a security event occurring in a computer system based on data representing features of the network device. The security event is associated with a potential security threat to the computer system, and the classification of the network device by the supervised machine learning is associated with a confidence. The technique includes, in response to the confidence being below a threshold, applying an active machine learning classifier to the data to learn a classification for the data and using the classification learned by the active machine learning classifier to adapt the supervised machine learning to recognize the classification.

Abstract: A technique includes accessing data representing a state of a given investigation of a potential security threat to a computer system by a security analyst. The state includes a result of a current investigative step of the investigation, and the analyst conducting the investigation uses an investigation graphical user interface (GUI). The technique includes applying machine learning that is trained on observed investigations to determine a recommendation to guide the analyst in a next investigative step for the given investigation. The technique includes communicating the recommendation through an output provided to the investigation GUI.

Abstract: A query is converted into a structured query tokenization. One or more query results visualizations for the query are determined by applying a supervised machine learning model to the structured query tokenization into which the query has been converted. Query results of the query are displayed using the determined query results visualizations.

Abstract: This document describes techniques and apparatuses for enhancing data-analytic visualizations of a data analytics system. A computing device captures input data and output data associated with a data-analytic visualization generated by an advanced user using the data analytics system. The input data and output data are mapped together for defining the data-analytic visualization generated. A machine learning model is trained relative to the mapped input data and output data for generating the data-analytic visualization. During a normal usage of the data analytics system by a user, the trained model generates data-analytic visualizations to suggest to the user responsive to input data from the user. An optional threshold is set and applied relative to the data-analytic visualizations generated. If a data-analytic visualization meets the threshold, the data analytics system reports the data-analytic visualization.

Abstract: Examples disclosed herein relate to providing enhanced threat intelligence on a security information sharing platform. Some examples may enable correlating a first set of items of threat information from the security information sharing platform. Some examples may enable, responsive to determining that the correlated first set of items of threat information indicate a first malicious action type, creating a new security indicator comprising information from the correlated first set of items of threat information and associating the new security indicator with the first malicious action type. Some examples may enable determining whether a first threat pattern exists based on the new security indicator.

Abstract: A method includes applying, by a computer, supervised machine learning to classify a network device that is associated with a security event occurring in a computer system based on data representing features of the network device. The security event is associated with a potential security threat to the computer system, and the classification of the network device by the supervised machine learning is associated with a confidence. The technique includes, in response to the confidence being below a threshold, applying an active machine learning classifier to the data to learn a classification for the data and using the classification learned by the active machine learning classifier to adapt the supervised machine learning to recognize the classification.

Abstract: A technique includes accessing data representing a state of a given investigation of a potential security threat to a computer system by a security analyst. The state includes a result of a current investigative step of the investigation, and the analyst conducting the investigation uses an investigation graphical user interface (GUI). The technique includes applying machine learning that is trained on observed investigations to determine a recommendation to guide the analyst in a next investigative step for the given investigation. The technique includes communicating the recommendation through an output provided to the investigation GUI.

Abstract: Examples disclosed herein relate to providing enhanced threat intelligence on a security information sharing platform. Some examples may enable correlating a first set of items of threat information from the security information sharing platform. Some examples may enable, responsive to determining that the correlated first set of items of threat information indicate a first malicious action type, creating a new security indicator comprising information from the correlated first set of items of threat information and associating the new security indicator with the first malicious action type. Some examples may enable determining whether a first threat pattern exists based on the new security indicator.