VISUALIZATIONS REPRESENTING POINTS CORRESPONDING TO EVENTS
In some examples, a system computes risk scores relating to points corresponding to events in a computing environment, using a plurality of different risk score computation techniques, and generates a plurality of visualizations representing the points. The plurality of visualizations include a first visualization representing the points and including the risk scores computed using a first risk score computation technique of the different risk score computation techniques, and a second visualization representing the points and including the risk scores computed using a second risk score computation technique of the different risk score computation techniques.
1 . A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:
compute risk scores relating to points corresponding to events in a computing environment, using a plurality of different risk score computation techniques;
generate a plurality of visualizations representing the points, the plurality of visualizations comprising:
a first visualization representing the points and including the risk scores computed using a first risk score computation technique of the different risk score computation techniques, and
a second visualization representing the points and including the risk scores computed using a second risk score computation technique of the different risk score computation techniques.
2 . The non-transitory machine-readable storage medium of claim 1 , wherein the computing of a first risk score of the risk scores comprises combining an anomaly score and an impact score.
3 . The non-transitory machine-readable storage medium of claim 1 , wherein the computing of the risk scores comprises computing, for a first point of the points:
a first risk score based on combining, using a first risk score computation technique, an anomaly score and an impact score for the first point, and
a second risk score based on combining, using a second risk score computation technique, the anomaly score and the impact score for the first point.
4 . The non-transitory machine-readable storage medium of claim 3 , wherein the first risk score is based on a product of the anomaly score and the impact score for the first point, and the second risk score is based on a mean using the anomaly score and the impact score for the first point.
5 . The non-transitory machine-readable storage medium of claim 4 , wherein the mean using the anomaly score and the impact score for the first point comprises a harmonic mean.
6 . The non-transitory machine-readable storage medium of claim 3 , wherein the first risk score is computed using a first formula responsive to a first relationship between the anomaly score and the impact score for the first point, and is computed using a second formula responsive to a second relationship between the anomaly score and the impact score for the first point.
7 . The non-transitory machine-readable storage medium of claim 6 , wherein the first formula comprises a product of the anomaly score and the impact score for the first point, and the second formula comprises a mean using the anomaly score and the impact score for the first point.
8 . The non-transitory machine-readable storage medium of claim 2 , wherein the first visualization comprises a first scatter plot relating anomaly scores to impact scores, and the second visualization comprises a second scatter plot relating anomaly scores to impact scores.
9 . The non-transitory machine-readable storage medium of claim 8 , wherein the first scatter plot comprises iso-contour curves corresponding to respective risk scores, and the second visualization comprises a second scatter plot relating anomaly scores to impact scores, wherein each iso-contour curve of the iso-contour curves in the first and second scatter plots represent a respective same risk score.
10 . The non-transitory machine-readable storage medium of claim 9 , wherein the instructions upon execution cause the system to:
define bins in the first scatter plot using the iso-contour curves of the first scatter plot, wherein a bin of the bins in the first scatter plot comprises a representation of at least one point of the points; and
define bins in the second scatter plot using the iso-contour curves of the second scatter plot, wherein a bin of the bins in the second scatter plot comprises a representation of at least one point of the points.
11 . The non-transitory machine-readable storage medium of claim 10 , wherein each bin of the bins in the first scatter plot represents a respective range of risk scores, and each bin of the bins in the second scatter plot represents a respective range of risk scores.
12 . The non-transitory machine-readable storage medium of claim 10 , wherein the bins in the first scatter plot are defined by further drawing curves that intersect the iso-contour curves of the first scatter plot, and the bins in the second scatter plot are defined by further drawing curves that intersect the iso-contour curves of the second scatter plot.
13 . The non-transitory machine-readable storage medium of claim 10 , wherein the instructions upon execution cause the system to:
receive a user selection of a first bin of the bins in the first scatter plot; and
responsive to the user selection, generate a representation of points represented in the first bin.
14 . The non-transitory machine-readable storage medium of claim 10 , wherein bins in a first part of the first scatter plot are larger than bins in a second part of the first scatter plot.
15 . A system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
compute risk scores relating to points corresponding to events in a computing environment, using a plurality of different risk score computation techniques that combine anomaly scores and impact scores in respective different ways;
generate a plurality of visualizations representing the points, the plurality of visualizations comprising:
a first visualization representing the points and including contours representing the risk scores computed using a first risk score computation technique of the different risk score computation techniques and
a second visualization representing the points and including contours representing the risk scores computed using a second risk score computation technique of the different risk score computation techniques.
16 . The system of claim 15 , wherein a contour of the contours in the first visualization comprises a first iso-contour that represents an individual risk score, and a contour of the contours in the second visualization comprises a second iso-contour that represents the individual risk score, the first iso-contour and the second iso-contour having different orientations.
17 . The system of claim 16 , wherein the instructions are executable on the processor to:
draw curves in the first visualization to provide bins with boundaries defined by the curves in the first visualization and the contours in the first visualization; and
draw curves in the second visualization to provide bins with boundaries defined by the curves in the second visualization and the contours in the second visualization.
18 . The system of claim 17 , wherein bins adjacent a lower left corner of the first visualization are smaller than bins adjacent an upper right corner of the first visualization, and wherein bins adjacent a lower left corner of the second visualization are larger than bins adjacent an upper right corner of the second visualization.
19 . A method performed by a system comprising a hardware processor, comprising:
computing first risk scores relating to points corresponding to events in a computing environment, using a first risk score formula that combines anomaly scores and impact scores in a first way;
computing second risk scores relating to the points corresponding to the events in the computing environment, using a second risk score formula that combines anomaly scores and impact scores in a second way different from the first way;
generating a first visualization including representations of the points relative to contours representing respective different first risk scores; and
generating a second visualization including representations of the points relative to contours representing respective different second risk scores.
20 . The method of claim 19 , further comprising:
computing third risk scores relating to the points corresponding to the events in the computing environment, using a third risk score formula that combines anomaly scores and impact scores in a third way different from the first way and the second way; and
generating a third visualization including representations of the points relative to contours representing respective different third risk scores.