Evented signatures

Reduce overhead of parsing behavior logs multiple times. With this, we do it only twice if all signatures installed are in fact evented.