Approaches for analyzing entity relationships

1. A system comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the system to perform:

obtaining log data from at least one computing system, the log data including a set of records that identifies Internet Protocol (IP) addresses of computing devices that accessed the at least one computing system and accounts hosted by the at least one computing system that were accessed by the computing devices and timestamps indicating respective times of access of the IP addresses;

determining, based at least in part on the obtained log data, that at least a first account and a second account were accessed from a computing device of the computing devices with an IP address of the IP addresses, and respective times that the first account and the second account were accessed based on the timestamps;

managing the first account and the second account as one or more objects in an object model, wherein each of the one or more objects comprises attachments of text documents, images, or videos, a free text container, and one or more links or edges that associate an object with other objects in the object model;

enriching the set of records to indicate whether the IP address has been whitelisted based on geolocation log data corresponding to the IP address and based on a type of traffic from devices assigned to the IP address;

in response to the IP address being whitelisted:

ingesting a report specifying the IP address as header data, the report further specifying that a third account was accessed using the IP address;

supplementing the ingested report including the header data using the object model;

merging, with the IP address, all of log data associated with the IP address with the one or more objects;

linking the third account, together with the first account and the second account, with the IP address; and

flagging the linked first account, the second account, and the third account to be reviewed based on the respective times that the first account and the second account were accessed.

2. The system of claim 1 , wherein the flagging further comprises:

flagging the linked first account, the second account, and the third account in response to determining that the first account, the second account, and the third account were accessed by the computing device within a specified timeframe.

3. The system of claim 1 , wherein the system further performs:

determining at least one record in the set of records that corresponds to a blacklisted IP address; and

removing the at least one record from the set of records.

4. The system of claim 1 , wherein the system further performs:

exporting data corresponding to the IP address to a data analysis tool for further evaluation.

5. The system of claim 4 , wherein the system further performs:

determining at least one object in the object model that corresponds to the IP address, the object model being managed by the data analysis tool.

6. The system of claim 1 , wherein the system further performs:

providing an interface through which the link between the first account and the second account is presented.

7. The system of claim 1 , wherein the

enriching the set of records further comprises including other extrinsic information.

8. The system of claim 7 , wherein enriching the at least one record comprises:

identifying a first record in the set of records;

determining that the IP address associated with the first record is blacklisted; and

associating the first record with information that indicates the IP address is blacklisted.

9. The system of claim 7 , wherein enriching the at least one record comprises:

identifying a first record in the set of records;

determining geolocation log data associated with the IP address associated with the first record; and

associating the geolocation log data with the first record.

10. The system of claim 1 , wherein the system further performs:

obtaining a set of financial reports from the at least one computing system, each financial report specifying one or more IP addresses used to access one or more financial accounts; and

determining at least a pair of financial accounts that were accessed by the computing device with the IP address.

11. A computer-implemented method, the method comprising:

obtaining log data from at least one computing system, the log data including a set of records that identifies Internet Protocol (IP) addresses of computing devices that accessed the at least one computing system and accounts hosted by the at least one computing system that were accessed by the computing devices and timestamps indicating respective times of access of the IP addresses;

determining, based at least in part on the obtained log data, that at least a first account and a second account were accessed from a computing device of the computing devices with an IP address of the IP addresses, and respective times that the first account and the second account were accessed based on the timestamps;

managing the first account and the second account as one or more objects in an object model, wherein each of the one or more objects comprises attachments of text documents, images, or videos, a free text container, and one or more links or edges that associate an object with other objects in the object model;

enriching the set of records to indicate whether the IP address has been whitelisted based on geolocation log data corresponding to the IP address and based on a type of traffic from devices assigned to the IP address;

in response to the IP address being whitelisted:

ingesting a report specifying the IP address as header data, the report further specifying that a third account was accessed using the IP address;

supplementing the ingested report including the header data using the object model;

merging, with the IP address, all of log data associated with the IP address with the one or more objects;

linking the third account, together with the first account and the second account, with the IP address; and

flagging the linked first account, the second account, and the third account to be reviewed based on the respective times that the first account and the second account were accessed.

12. The computer-implemented method of claim 11 , the flagging further comprising:

flagging the linked first account, the second account, and the third account in response to determining that the first account, the second account, and the third account were accessed by the computing device within a specified timeframe.

13. The computer-implemented method of claim 11 , the method further comprising:

determining at least one record in the set of records that corresponds to a blacklisted IP address; and

removing the at least one record from the set of records.

14. The computer-implemented method of claim 11 , the method further comprising:

exporting data corresponding to the IP address to a data analysis tool for further evaluation.

15. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors to perform:

obtaining log data from at least one computing system, the log data including a set of records that identifies Internet Protocol (IP) addresses of computing devices that accessed the at least one computing system and accounts hosted by the at least one computing system that were accessed by the computing devices and timestamps indicating respective times of access of the IP addresses;

determining, based at least in part on the obtained log data, that at least a first account and a second account were accessed from a computing device of the computing devices with an IP address of the IP addresses, and respective times that the first account and the second account were accessed based on the timestamps;

managing the first account and the second account as one or more objects in an object model, wherein each of the one or more objects comprises attachments of text documents, images, or videos, a free text container, and one or more links or edges that associate an object with other objects in the object model;

enriching the set of records to indicate whether the IP address has been whitelisted based on geolocation log data corresponding to the IP address and based on a type of traffic from devices assigned to the IP address;

in response to the IP address being whitelisted:

ingesting a report specifying the IP address as header data, the report further specifying that a third account was accessed using the IP address;

supplementing the ingested report including the header data using the object model;

merging, with the IP address, all of log data associated with the IP address with the one or more objects;

linking the third account, together with the first account and the second account, with the IP address; and

flagging the linked first account, the second account, and the third account to be reviewed based on the respective times that the first account and the second account were accessed.

16. The non-transitory computer readable medium of claim 15 , wherein the flagging further comprises:

flagging the linked first account, the second account, and the third account in response to determining that the first account, the second account, and the third account were accessed by the computing device within a specified timeframe.

17. The non-transitory computer readable medium of claim 15 , wherein the instructions, when executed, further cause the processors to perform:

determining at least one record in the set of records that corresponds to a blacklisted IP address; and

removing the at least one record from the set of records.

18. The non-transitory computer readable medium of claim 15 , wherein the instructions, when executed, further cause the processors to perform:

exporting data corresponding to the IP address to a data analysis tool for further evaluation.

19. The non-transitory computer readable medium of claim 18 , wherein the instructions, when executed, further cause the processors to perform:

creating the object based on an object graph, the object graph being created by the object model and the object model being managed by the data analysis tool.