A method comprising: detecting a plurality of events occurring at a monitored computing device of a plurality of monitored computing devices (104, 106), wherein individual events of the plurality of events are associated with an event type, and the event type is associated with a pattern set; determining match records associated with the individual events of the plurality of events based at least in part on matching at least one pattern of the pattern set with the individual events; providing, for each match record of the match records satisfying a corresponding condition, a respective candidate record of candidate records comprising a respective first tag associated with the corresponding condition; receiving, via a user interface, a tag criterion; providing, for each candidate record of the candidate records having the respective first tag satisfying the tag criterion, a respective result record of result records comprising at least some data of the respective match record; presenting, via the user interface, the result records; receiving, via the user interface, a second condition; providing, for each second match record of the match records satisfying the second condition, a respective second candidate record of second candidate records comprising a second respective tag associated with the second condition; providing, for each second candidate record of the second candidate records having the respective second tag satisfying the tag criterion, a respective second result record of second result records comprising at least some data of the respective second match record; and presenting, via the user interface, the second result records. detecting a plurality of events occurring at a monitored computing device of a plurality of monitored computing devices (104, 106), wherein individual events of the plurality of events are associated with an event type, and the event type is associated with a pattern set; determining match records associated with the individual events of the plurality of events based at least in part on matching at least one pattern of the pattern set with the individual events; providing, for each match record of the match records satisfying a corresponding condition, a respective candidate record of candidate records comprising a respective first tag associated with the corresponding condition; receiving, via a user interface, a tag criterion; providing, for each candidate record of the candidate records having the respective first tag satisfying the tag criterion, a respective result record of result records comprising at least some data of the respective match record; presenting, via the user interface, the result records; receiving, via the user interface, a second condition; providing, for each second match record of the match records satisfying the second condition, a respective second candidate record of second candidate records comprising a second respective tag associated with the second condition; providing, for each second candidate record of the second candidate records having the respective second tag satisfying the tag criterion, a respective second result record of second result records comprising at least some data of the respective second match record; and presenting, via the user interface, the second result records.