A computer-implemented method, comprising: receiving, via a communications interface, a plurality of command-line records associated with respective events of a plurality of events, wherein: each of the command-line records is associated with a corresponding monitored computing device of a plurality of monitored computing devices; for each event of the plurality of events, determining a respective event vector based at least in part on a trained representation mapping and on the respective command-line record, each event vector representing the respective event and having a first number of elements; determining, for each of the plurality of event vectors, by one or more reduction, clustering or projection operations a respective coordinate vector having a second number of elements smaller than the first number of elements and representing a position of the respective event in a feature space defined by the plurality of event vectors; presenting, via an electronic display, respective representations of at least some events of the plurality of events at the respective coordinate vectors; receiving, via a user interface, a selection of a first representation of the respective representations, the first representation associated with a first event; clustering the events of the plurality of events into a plurality of clusters by assigning, based at least in part on the plurality of event vectors, each event to a cluster of the plurality of clusters; determining a first cluster of the plurality of clusters based at least in part on the selection, wherein the first cluster includes the first event; receiving, via the UI, an indication of a tag; and associating each event of the first cluster of events with the tag. receiving, via a communications interface, a plurality of command-line records associated with respective events of a plurality of events, wherein: each of the command-line records is associated with a corresponding monitored computing device of a plurality of monitored computing devices; for each event of the plurality of events, determining a respective event vector based at least in part on a trained representation mapping and on the respective command-line record, each event vector representing the respective event and having a first number of elements; determining, for each of the plurality of event vectors, by one or more reduction, clustering or projection operations a respective coordinate vector having a second number of elements smaller than the first number of elements and representing a position of the respective event in a feature space defined by the plurality of event vectors; presenting, via an electronic display, respective representations of at least some events of the plurality of events at the respective coordinate vectors; receiving, via a user interface, a selection of a first representation of the respective representations, the first representation associated with a first event; clustering the events of the plurality of events into a plurality of clusters by assigning, based at least in part on the plurality of event vectors, each event to a cluster of the plurality of clusters; determining a first cluster of the plurality of clusters based at least in part on the selection, wherein the first cluster includes the first event; receiving, via the UI, an indication of a tag; and associating each event of the first cluster of events with the tag.