A method for processing data on a server device, the method comprising: (a) receiving at the server device at least one log file relating to resources of interest on a client device, the resources of interest comprising at least one of a new file on the client device, a new registry key on the client device, and a new network host with which the client device communicated; (b) in response to a resource of interest being a new file: determining at the server device whether the new file is on a blacklist of known malware or on a whitelist of known clean files based on a full-file fingerprint extracted from the at least one log file; determining whether the new file is malicious based on a feature vector of the new file extracted from the at least one log file; determining a prevalence of the new file among a community of client devices based on a numeric count of other client devices having the new file; and determining a first time the new file was detected on a client device within the community of client devices; (c) in response to a resource of interest being a registry key: determining at the server device whether the registry key was created by a known piece of malware; (d) in response to a resource of interest being a new network host with which the client device communicated: determining at the server device whether the new host has previously been associated with malicious activity; and (e) generating at the server device an interactive report indicative of a presence or absence of malware on the client device based on (b) - (d), wherein the interactive report provides an initial summary view for the resource of interest and, upon being clicked, the interactive report expands into a detailed trajectory report for the resource of interest that includes events associates with the resource of interest. (a) receiving at the server device at least one log file relating to resources of interest on a client device, the resources of interest comprising at least one of a new file on the client device, a new registry key on the client device, and a new network host with which the client device communicated; (b) in response to a resource of interest being a new file: determining at the server device whether the new file is on a blacklist of known malware or on a whitelist of known clean files based on a full-file fingerprint extracted from the at least one log file; determining whether the new file is malicious based on a feature vector of the new file extracted from the at least one log file; determining a prevalence of the new file among a community of client devices based on a numeric count of other client devices having the new file; and determining a first time the new file was detected on a client device within the community of client devices; determining at the server device whether the new file is on a blacklist of known malware or on a whitelist of known clean files based on a full-file fingerprint extracted from the at least one log file; determining whether the new file is malicious based on a feature vector of the new file extracted from the at least one log file; determining a prevalence of the new file among a community of client devices based on a numeric count of other client devices having the new file; and determining a first time the new file was detected on a client device within the community of client devices; (c) in response to a resource of interest being a registry key: determining at the server device whether the registry key was created by a known piece of malware; (d) in response to a resource of interest being a new network host with which the client device communicated: determining at the server device whether the new host has previously been associated with malicious activity; and (e) generating at the server device an interactive report indicative of a presence or absence of malware on the client device based on (b) - (d), wherein the interactive report provides an initial summary view for the resource of interest and, upon being clicked, the interactive report expands into a detailed trajectory report for the resource of interest that includes events associates with the resource of interest.