A system comprising: one or more processors; a memory communicatively coupled to the one or more processors; a network interface for transmitting one or more cardinality-based activity pattern queries to the plurality of monitored computing systems and receiving security-relevant data from a plurality of monitored computing systems; an activity pattern detection module stored in the memory and executable by the one or more processors, the activity pattern detection module configured to detect activity patterns in the received security-relevant data based on a comparison of the received security-relevant data to a plurality of defined activity patterns, wherein each defined activity pattern represents one or more discrete behaviors that may occur in a single execution flow on a monitored computing system of the plurality of monitored computing systems; a detection data store configured to maintain data representing the detected activity patterns, wherein the data representing a particular detected activity pattern includes: a time at which the activity pattern occurred; and data indicating a particular monitored computing system of the plurality of monitored computing systems on which the activity pattern occurred; and an activity pattern cardinality query module stored in the memory and executable by the one or more processors, the activity pattern cardinality query module configured to execute a query against the detection data store, wherein: the query specifies a cardinality; the query specifies a time period; and when the query is executed, results of the query indicate one or more monitored computing systems of the plurality of monitored computing systems on which activity patterns satisfying the specified cardinality occurred within the specified time period. one or more processors; a memory communicatively coupled to the one or more processors; a network interface for transmitting one or more cardinality-based activity pattern queries to the plurality of monitored computing systems and receiving security-relevant data from a plurality of monitored computing systems; an activity pattern detection module stored in the memory and executable by the one or more processors, the activity pattern detection module configured to detect activity patterns in the received security-relevant data based on a comparison of the received security-relevant data to a plurality of defined activity patterns, wherein each defined activity pattern represents one or more discrete behaviors that may occur in a single execution flow on a monitored computing system of the plurality of monitored computing systems; a detection data store configured to maintain data representing the detected activity patterns, wherein the data representing a particular detected activity pattern includes: a time at which the activity pattern occurred; and data indicating a particular monitored computing system of the plurality of monitored computing systems on which the activity pattern occurred; and a time at which the activity pattern occurred; and data indicating a particular monitored computing system of the plurality of monitored computing systems on which the activity pattern occurred; and an activity pattern cardinality query module stored in the memory and executable by the one or more processors, the activity pattern cardinality query module configured to execute a query against the detection data store, wherein: the query specifies a cardinality; the query specifies a time period; and when the query is executed, results of the query indicate one or more monitored computing systems of the plurality of monitored computing systems on which activity patterns satisfying the specified cardinality occurred within the specified time period. the query specifies a cardinality; the query specifies a time period; and when the query is executed, results of the query indicate one or more monitored computing systems of the plurality of monitored computing systems on which activity patterns satisfying the specified cardinality occurred within the specified time period.