Patent ID: 9596252
Date: 2017-03-14
CPC Classifications: G06F,H04L

Claim:
1. A method, comprising: creating an event group from a plurality of time-stamped, searchable events stored in a field-searchable, non-tabular data store, each event in the event group having a portion of raw machine data reflecting activity in an information technology environment and matching criteria relating to one or more field values extracted from one or more fields present in the portion of raw machine data, wherein the criteria is evaluated using an extraction rule applied to at least a portion of the plurality of time-stamped, searchable events; determining an event group summary, the summary summarizing field values from one or more fields of the events in the event group; causing display of a graphical user interface displaying a plurality of event group summaries including the event group summary; based on user input in response to the display of the graphical user interface, changing a visual appearance of a selected event group summary among the displayed plurality of event group summaries to indicate that the selected event group summary is a security threat or removing the selected event group summary from the displayed plurality of event group summaries indicating that the selected event group summary is not a security threat; wherein the method is performed by one or more computing devices.