Patent ID: 11876821
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 19:
20. A non-transitory computer-readable storage medium storing instructions, execution of which by a processor causing the processor to:
receive first event data indicative of a first activity on a computer network and second event data indicative of a second activity on the computer network;
apply a first machine learning anomaly detection model to the first event data, by a real-time analysis engine operated in real time, to detect first anomaly data;
apply a second machine learning anomaly detection model to the first anomaly data and the second event data, by a batch analysis engine operated by the threat detection system in a batch mode, to detect second anomaly data;
detect third anomaly data using an anomaly detection rule; and
process, using a threat indicator model, the first anomaly data, the second anomaly data, and the third anomaly data to identify a threat indicator associated with a potential security threat to the computer network.