Patent ID: 8752178

Claim:
A computer-implemented method, comprising: receiving, on a computing device, raw data; identifying one or more events in the raw data, wherein each of the one or more events includes information relating to computer security or network security; storing the one or more events in a searchable data store, wherein an event includes one or more fields, and wherein a field has a corresponding value; using a schema to extract values for fields in the one or more events; determining a subset group of events, wherein the subset group of events is determined using the extracted values corresponding to the one or more fields; presenting a graphical interface including a summary of the subset group of events, one or more other summaries of events, and a remove element, wherein the remove element is associated with the summary of the subset group of events; receiving input corresponding to an interaction with of the remove element, wherein interacting with the remove element causes the summary of the subset group of events to be removed from the graphical interface that displays the one or more other summaries of events; and in response to an interaction with the remove element, updating the graphical interface to remove the summary of the subset group of events from the graphical interface that displays the one or more other summaries of events.