Computer-security event analysis

1. A method comprising:

detecting, at a monitored computing device of a plurality of monitored computing devices, a plurality of events, wherein individual events of the plurality of events are associated with an event type, and the event type is associated with a pattern set;

determining match records associated with the individual events of the plurality of events based at least in part on matching at least one pattern of the pattern set with the individual events;

providing, for each match record of the match records satisfying a corresponding condition of a condition set, a respective candidate record of candidate records comprising a respective first tag associated with the corresponding condition;

receiving, via a user interface, a tag criterion;

providing, for each candidate record of the candidate records having the respective first tag satisfying the tag criterion, a respective result record of result records comprising at least some data of the respective match record;

presenting, via the user interface, the result records;

receiving, via the user interface, a second condition;

providing, for each second match record satisfying the second condition, a respective second candidate record of second candidate records comprising a second respective tag associated with the second condition;

providing, for each second candidate record of the second candidate records having the second respective tag satisfying the tag criterion, a respective second result record of second result records comprising at least some data of the respective second match record; and

presenting, via the user interface, the second result records.

2. The method according to claim 1 , further comprising, before receiving the second condition:

receiving, via the user interface, a selection of a selected result record of the result records;

populating a condition-builder interface based at least in part on the selected result record; and

presenting, via the user interface, the condition-builder interface.

3. The method according to claim 1 , further comprising:

receiving, via a second user interface different from the user interface, a second tag criterion;

providing, for at least one of the second candidate records having the second respective tag satisfying the second tag criterion, a respective third result record comprising at least some data of the respective event record; and

presenting, via the second user interface, the third result records.

4. The method according to claim 1 , further comprising:

providing, for one or more events of the plurality of events associated with one or more event types included in a match list, respective event records, wherein the match list includes event types associated with chains of execution activities detected on the monitored computing device; and

providing, for each event record matching a corresponding pattern of one or more patterns associated with the respective event type, the respective match record of the match records, the respective match record comprising:

an identifier of the corresponding pattern, and

at least some data of the respective event record.

5. The method according to claim 1 , further comprising:

before providing the candidate records:

retrieving data from a data source based at least in part on a match record of the match records;

updating the match record to include the data; and

determining the respective candidate record associated with the match record based at least in part on the data in the match record satisfying a data criterion of the corresponding condition.

6. The method according to claim 1 , further comprising:

receiving one or more supplemental records from a data source; and

providing, for each supplemental record satisfying a corresponding condition of the condition set, a respective candidate record comprising a tag associated with the corresponding condition.

7. The method according to claim 1 , further comprising:

providing, in response to a match record of the match records satisfying the corresponding condition, the respective candidate record identifying a notification target; and

transmitting, to the notification target, a notification of the respective candidate record.

8. A system, comprising:

a computer-readable memory storing a condition set having one or more conditions;

a communications interface configured to receive event records of a plurality of events, an individual event record of the event records associated with a monitored computing device and associated with an event type;

a matching subsystem configured to:

access a pattern set associated with the event type; and

provide, for the individual event record matching a corresponding pattern of the pattern set, a match record comprising an identifier of the corresponding pattern, and at least some data of the individual event record;

an updating subsystem configured to:

receive, from a user interface, a modification record specifying a modification to a condition; and

apply the modification record to the condition set to provide an updated condition set; and

a testing subsystem configured to provide, for the match record satisfying a corresponding condition of the updated condition set, a respective candidate record comprising a tag associated with the corresponding condition.

9. The system according to claim 8 , wherein:

the matching subsystem comprises a plurality of compiled subroutines corresponding to respective ones of the pattern sets;

the matching subsystem is further configured to test an event record of the event records against the pattern set associated with the respective event type by executing the respective compiled subroutine of the plurality of compiled subroutines;

the updating subsystem comprises a parser configured to parse a textual condition specification in the modification record and provide corresponding modification instructions; and

the updating subsystem is further configured to apply the modification record at least partly by carrying out the corresponding modification instructions.

10. The system according to claim 8 , wherein the testing subsystem is further configured to:

determine that the match record of match records includes a match tag; and

provide the respective candidate record of candidate records excluding the match tag, based on the corresponding condition.

11. The system according to claim 8 , wherein:

the computer-readable memory further stores an identifier set; and

the matching subsystem is further configured to:

determine that an event record of the event records comprises an identifier listed in the identifier set; and

provide the respective match record of the match records comprising a second tag, wherein the second tag is associated with the identifier.

12. The system according to claim 8 , wherein:

an event record of the event records identifies a system component of the corresponding monitored computing device;

the pattern set associated with an indication defines a component criterion;

the system further comprises a history subsystem configured to determine an ancestor system component associated with the system component; and

the matching subsystem is configured to determine that the event record matches the corresponding pattern at least partly based at least in part on the ancestor system component satisfying the component criterion.

13. The system according to claim 8 , wherein:

an event record of the event records comprises text data;

the pattern set associated with the event type of the event record defines a text criterion; and

the matching subsystem is configured to determine that the event record matches the corresponding pattern at least partly based at least in part on the text data satisfying the text criterion.

14. The system according to claim 8 , wherein the testing subsystem is further configured to:

provide, for a first match record of the respective match records, a first candidate record, wherein the first match record satisfies a corresponding second condition of the condition set; and

subsequent to receiving the modification record, add, remove, or modify at least one tag of the first candidate record based at least in part on at least one of the modification record or the updated condition set.

15. A method comprising:

receiving event records of a plurality of events, an event record of the event records associated with a monitored computing device and an event type;

accessing a pattern set associated with the event type;

providing, based on the event record matching a corresponding pattern of the pattern set, a match record of match records comprising:

an identifier of the corresponding pattern, and

at least some data of the event record; and

providing, for the match record satisfying a corresponding condition of a condition set, a candidate record comprising a tag associated with the corresponding condition.

16. The method according to claim 15 , further comprising:

receiving, via a user interface, a modification record specifying a modification to a condition;

applying the modification record to the condition set to provide an updated condition set; and

providing, for the match record satisfying a corresponding second condition of the updated condition set, a second candidate record comprising a tag associated with the corresponding second condition.

17. The method according to claim 16 , further comprising:

providing, for a first match record of the match records, a first candidate record, wherein the first match record satisfies a corresponding second condition of the condition set; and

subsequent to receiving the modification record, adding, removing, or modifying at least one tag of the first candidate record based at least in part on at least one of the modification record or the updated condition set.

18. The method according to claim 15 , further comprising:

determining that the event record comprises the identifier listed in an identifier set; and

providing the match record comprising a second tag, wherein the second tag is associated with the identifier.

19. The method according to claim 15 , wherein:

the event record identifies a system component of the corresponding monitored computing device;

the pattern set associated with the event type of the event record defines a component criterion; and

the method further comprises:

determining an ancestor system component associated with the system component; and

determining that the event record matches the corresponding pattern of the pattern set based at least in part on the ancestor system component satisfying the component criterion.

20. The method according to claim 15 , wherein:

the event record comprises text data;

the pattern set associated with the event type of the event record defines a text criterion; and

the method further comprises determining that the event record matches the corresponding pattern of the pattern set based at least in part on the text data satisfying the text criterion.