Event Pattern Authoring

The majority of pattern detection logic is configured in the event pattern view. In this environment, you define how to find matches from incoming data via elements, either by themselves, or in relation with other elements by means of constraints. Once a pattern is detected, outcomes are used to produce output data based on the input data or computational results of the input data.

Working with Elements

An element is a unit of pattern detection logic that defines what parts of the incoming data constitute a match. In other words, elements tell the system what kinds of things to look for in the data. For more information about elements, see Model Artifacts.

Creating Elements

To create an element:

1. In the tool palette, click the Element (⬭) icon.
2. Click the event type to associate with the new element. Click New Event Type to create new event types, and then follow the instructions in Creating New Event Types.
3. Click any open space in the diagramming area to place the element.
4. In the details panel, edit the element’s properties as needed. For more information, see Editing Elements.

Elements may also be created directly on the canvas as follows:

1. Right-click any empty space in the canvas.
2. In the selection menu, click Add Element.
3. In the dialog, select an event type. To create a new event type, click New, then follow the instructions in Creating New Event Types.

Note

Depending on the source of the input data, elements in the event pattern view may have differently shaded colors:

• An element associated with a raw event type is deep blue.
• An element associated with a derived event type (that is, one that comes from an output of a lower-level event pattern) is brighter blue.

Editing Elements

When an element is selected in the event pattern view, its information is displayed in the details panel, where the element's details can be viewed and modified as needed.

To edit an element:

1. In the diagramming area, click the element to edit.
2. In the details panel, click the Contents tab if it is not already selected.
3. Edit the element’s details as necessary:
   1. Under Attributes:
      1. From the Event Types dropdown menu, select the event type to modify the event type associated with the element.
      2. In the Alias field, enter an alias for labeling the element. (It is recommended that the alias describe the element’s unique role in its event pattern that differentiates it from other elements using the same event type.)
      3. In the Min field, specify the minimum number of events the element must receive.
      4. In the Max field, specify the maximum number of events the element must receive.
      5. Under Time to Live, define an expiration period for the element if needed:
         1. Click +. The Create Time-To-Live dialog opens.
         2. In the Time Value field, enter a number indicating how long the element should remain valid.
         3. From the dropdown menu, select the appropriate unit of time for the specified time value.
         4. Click Create to create the expiration period, or Cancel to discard it.
         5. Edit the expiration period by changing the field values, if needed.
         6. Click the Delete (trash can) icon to clear the entered values, if necessary.
   2. Under the Event Type section (which uses the name of the event type selected for the element):
      1. Click the pencil (✎) icon to edit the details.
      2. Follow the procedure in Editing Event Types.

Working with Outcomes

An outcome is a unit of pattern detection logic that represents output data. In other words, once the system finds a pattern established in an element, an outcome tells the system what to do after that discovery. For more information about outcomes, see Model Artifacts.

Creating Outcomes

To create an outcome:

1. In the tool palette, click the Outcome (▭) icon.
2. Select the event type to associate with the new outcome. If a new event type should be created for the outcome, follow the process in Creating New Event Types.
3. Click any open space in the diagramming area to place the outcome.
4. In the details panel, edit the outcome’s properties as needed. For more information, see Editing Outcomes.

Outcomes may also be created directly on the canvas as follows:

1. Right-click any empty space in the canvas.
2. In the selection menu, click Add Outcome.
3. In the dialog, select an event type. If a new event type should be created, click New, then follow the instructions in Creating New Event Types.

Editing Outcomes

When an outcome is selected in the event pattern view, its information is displayed in the details panel, where the outcome's details can be viewed and modified as needed.

To edit an outcome:

1. In the diagramming area, click an outcome to edit.
2. In the details panel, click the Content tab if it is not already selected.
3. Edit the outcome’s details as needed:
   1. Under Attributes:
      1. Under Sources, click a source to edit its details. For more information, see Editing Elements.
      2. Under Computations, click a computation to check its details. Click the Delete (trash can) icon beside a computation to delete it. For more information about computations, see Built-In Computation Functions.
      3. Under Risk, choose the appropriate risk type:
         1. If the risk factors (elements) are independent from one another, select Weighted to assign a weight to each element.
         2. If the risk factors (elements) are dependent upon one another, select Bayesian to specify the conditions used to compute risk.
      4. Under Output Windowing, select the kind of output windowing to use from the Type dropdown menu. For more information, see Configuring Output Windowing.
   2. Under the Outcome section (which uses the name of the selected outcome):
      1. Click the pencil (✎) icon to edit the details.
      2. Follow the procedure in Editing Event Types.

Configuring Output Windowing

Output windowing defines an interval of time during which the system listens to incoming data streams, and only publishes the data's updated (latest) state during that interval.

Note

The output windowing interval refers to server time (time elapsed during the operation of the server), not data time (time specified in the data's timestamps or metadata).

To configure output windowing for event patterns:

1. In the diagramming area, click an outcome to provide output windowing.
2. In the details panel, click the Contents tab if not already selected.
3. Click the Output Windowing section to expand it.
4. From the Type dropdown menu, select the output windowing to use.
5. In the Time Value field, enter the interval of time that the output window should span.
6. From the unit dropdown menu to the right of the Time Value field, select the appropriate unit for the time value.
7. Click outside of the details menu to save the changes.

Working with Constraints

A constraint is a condition placed upon an input event for an event pattern to be considered a match. For more information about constraints, see Model Artifacts.

Creating Constraints

To create a constraint:

1. In the diagramming area, click an element.
2. Click the Connection (🔀) button, then drag the line to another element.
3. In the Create a Constraint dialog:
   1. For the first (green) element:
      1. Click the Fields dropdown menu.
      2. Select the appropriate field name. If the list is too long, type the first few characters of the field’s name to narrow down the list.
      3. Click Computations if computations based on field values are needed to produce a result for comparison. For more information, see Constraint Computations Authoring.
   2. Repeat steps 3.i.a–3.i.c for the second (yellow) element.
   3. Click the Comparison Option dropdown menu to select a comparison option for the two elements.
      1. In the Offset field, if necessary, specify a value to add to the source event to create a single valid scalar value for comparison operations.
      2. In the Tolerance field, if necessary, specify a value to add and subtract from the source event to create a range of valid values for comparison operations.
4. Click OK to create the constraint, or click Cancel to discard it.

Editing Constraints

To edit a constraint:

1. In the diagramming area, click a constraint to edit.
2. In the details panel, click the Contents tab if it is not already selected.
3. For the first (green) element:
   1. Click the Fields dropdown menu.
   2. Select the appropriate field name. If the list is too long, type the first few characters of the field’s name to narrow down the list.
   3. Click Computations if computations based on field values are needed to produce a result for comparison. For more information, see Constraint Computations Authoring.
4. Repeat steps 3.i-3.iii for the second (yellow) element.
5. Click the Comparison Option dropdown menu to a select a comparison option for the two elements.
6. Click anywhere outside the details panel to save the changes.

Editing Groups

The only editable attribute of a group is its color.

Note

Groups are a legacy feature in Cogynt, and no longer serve any necessary functions.

To change the color of a group:

1. In the diagramming area, click the group to edit.
2. In the details panel, click the Contents tab if it's not already selected.
3. Click the color bar above the Members section.
4. From the color palette, select the desired color.
5. Click anywhere outside the color palette to close it and save the change.

For more information about groups, see Model Artifacts.

Creating Partitions

Partitions instruct the system to analyze events based on a particular field within a specified event pattern.

To create a partition for an event pattern:

1. In the diagramming area, click an event pattern to give a partition.
2. In the details panel, click the Contents tab if it is not already selected.
3. Under Attributes, click the Partitions section to expand it.
4. Click +.
5. In the Create Partition dialog:
   1. From the Elements dropdown menu, select an element containing the field to partition over.
   2. From the Fields dropdown menu, select the field to partition over. (The Fields dropdown menu cannot be opened until a selection is made from Elements.)
6. Click Create to create the partition, or click Cancel to discard it.