Audit log report generator
A method of generating a supplemental user interface is disclosed. At a client system, it is detected that an alert identifying a suspicious activity that is to be reviewed by a user of the client system has been received. A template for a user interface is accessed. The template includes database queries and instructions for presenting data items derived from query results corresponding to the database queries in the user interface. The instructions include a mapping of the data items to data fields of the user interface. Data items derived from the query results are presented in the user interface based on the instructions included in the template. An audit log is updated based on an acceptance by the user of the data items presented in the user interface.
1. A method comprising:
performing operations for generating a supplemental user interface for presentation on a client device in conjunction with a primary user interface presented on the client device, the supplemental user interface including custom data fields to assist a user in completion of investigative steps pertaining to an alert presented in the primary user interface, the operations comprising:
determining that the alert has been received from a server system and presented in the primary user interface, the alert identifying a suspicious activity that is to be reviewed by the user;
selecting a template for the supplemental user interface from a plurality of templates based on a type of the alert;
accessing the template for the supplemental user interface, the template including database queries and instructions for presenting data items derived from query results corresponding to the database queries in the custom data fields, the instructions include a mapping of the data items to the custom data fields and a layout for the custom data fields within the supplemental user interface, wherein the database queries are specified in a front-end query language;
consolidating two or more of the database queries into an additional database query specified in a back-end query language; and
receiving query results corresponding to the additional database query;
presenting the data items derived from the query results in the custom data fields of the supplemental user interface based on the instructions included in the template; and
updating an audit log based on an acceptance by the user of the data items presented in the custom data fields of the supplemental user interface.
2. The method of claim 1 , the operations further comprising selecting the two or more database queries based on an anticipated performance improvement pertaining to the presenting of the data items in the user interface.
3. The method of claim 1 , wherein the two or more database queries are each specified in a front-end query language that corresponds to a persistent database store and wherein the back-end query language corresponds to an in-memory data store.
4. The method of claim 1 , the operations further comprising:
translating at least one of the database queries specified in the front-end query language into database queries specified in a back-end query language;
communicating the database queries specified in the back-end query language to the server system;
receiving query results corresponding to the database queries specified in the back-end query language; and
translating the query results corresponding to the database queries specified in the back-end query language into query results corresponding to the database queries specified in the front-end query language.
5. The method of claim 1 , further comprising determining the type of the alert based on a detection scenario that triggered the alert.
6. The method of claim 1 , wherein each of the plurality of templates is predesigned for a different type of alert.
7. The method of claim 1 , wherein the updating of the data log is further based on additional findings, recommendations, or remarks entered by the user into additional data fields of the supplemental user interface.
8. The method of claim 1 , wherein the template is predesigned to retrieve and consolidate results of investigative steps for the type of the alert that are manually performable within the primary user interface.
9. A system comprising:
one or more modules implemented by one or more processors of a client system, the one or more modules configured to perform operations for generating a supplemental user interface for presentation on a client device in conjunction with a primary user interface presented on the client device, the supplemental user interface including custom data fields to assist a user in completion of investigative steps pertaining to an alert presented in the primary user interface, the operations comprising:
determining that the alert has been received from a server system and presented in the primary user interface, the alert identifying a suspicious activity that is to be reviewed by the user;
selecting a template for the supplemental user interface from a plurality of templates based on a type of the alert;
accessing the template for the supplemental user interface, the template including database queries and instructions for presenting data items derived from query results corresponding to the database queries in the custom data fields, the instructions include a mapping of the data items to the custom data fields and a layout for the custom data fields within the supplemental user interface, wherein the database queries are specified in a front-end query language;
consolidating two or more of the database queries into an additional database query specified in a back-end query language; and
receiving query results corresponding to the additional database query;
presenting the data items derived from the query results in the custom data fields of the supplemental user interface based on the instructions included in the template; and
updating an audit log based on an acceptance by the user of the data items presented in the custom data fields of the supplemental user interface.
10. The system of claim 9 , the operations further comprising selecting the two or more database based on an anticipated performance improvement pertaining to the presenting of the data items in the user interface.
11. The system of claim 10 , wherein the front-end query language that corresponds to a persistent database store and wherein the back-end query language corresponds to an in-memory data store.
12. The system of claim 9 , the operations further comprising:
translating at least one of the database queries specified in the front-end query language into database queries specified in a back-end query language;
communicating the database queries specified in the back-end query language to the server system;
receiving query results corresponding to the database queries specified in the back-end query language; and
translating the query results corresponding to the database queries specified in the back-end query language into query results corresponding to the database queries specified in the front-end query language.
13. A non-transitory machine readable medium comprising a set of instructions that, when executed by one or more processors of a client system, causes the one or more processors to perform operations for generating a supplemental user interface for presentation on a client device in conjunction with a primary user interface presented on the client device, the supplemental user interface including custom data fields to assist a user in completion of investigative steps pertaining to an alert presented in the primary user interface, the operations comprising, the operations comprising:
determining that the alert has been received from a server system and presented in the primary user interface, the alert identifying a suspicious activity that is to be reviewed by the user;
selecting a template for the supplemental user interface from a plurality of templates based on a type of the alert;
accessing the template for the supplemental user interface, the template including database queries and instructions for presenting data items derived from query results corresponding to the database queries in the custom data fields, the instructions include a mapping of the data items to the custom data fields and a layout for the custom data fields within the supplemental user interface, wherein the database queries are specified in a front-end query language;
consolidating two or more of the database queries into an additional database query specified in a back-end query language; and
receiving query results corresponding to the additional database query;
presenting the data items derived from the query results in the custom data fields of the supplemental user interface based on the instructions included in the template; and
updating an audit log based on an acceptance by the user of the data items presented in the custom data fields of the supplemental user interface.
14. The non-transitory machine readable medium of claim 13 , the operations further comprising selecting the two or more database queries based on an anticipated performance improvement pertaining to the presenting of the data items in the user interface.
15. The non-transitory machine readable medium of claim 13 , wherein the front-end query language corresponds to a persistent database store and wherein the back-end query language corresponds to an in-memory data store.