A computer-implemented method comprising employing a server computer system configured to protect a plurality of client systems against computer security threats to: in response to receiving a forensic indicator, select a first routine for evaluating a first security predicate from a plurality of routines, the first routine selected according to the forensic indicator, wherein the forensic indicator comprises a plurality of metadata elements characterizing a network flow between a client system of the plurality of client systems and another party; and select a second routine for evaluating a second security predicate from the plurality of routines, the second routine selected according to a result of executing the first routine; the method further employing the server computer to: in response to selecting the first routine, add a first text message to a security alert indicating whether the client system is subject to a computer security threat, the first text message determined according to a first message template selected according to the first routine; in response to selecting the second routine, add a second text message to the security alert, the second text message determined according to a second message template selected according to the second routine; and transmit the security alert to an administration device configured to display the security alert to a human operator. in response to receiving a forensic indicator, select a first routine for evaluating a first security predicate from a plurality of routines, the first routine selected according to the forensic indicator, wherein the forensic indicator comprises a plurality of metadata elements characterizing a network flow between a client system of the plurality of client systems and another party; and select a second routine for evaluating a second security predicate from the plurality of routines, the second routine selected according to a result of executing the first routine; the method further employing the server computer to: in response to selecting the first routine, add a first text message to a security alert indicating whether the client system is subject to a computer security threat, the first text message determined according to a first message template selected according to the first routine; in response to selecting the second routine, add a second text message to the security alert, the second text message determined according to a second message template selected according to the second routine; and transmit the security alert to an administration device configured to display the security alert to a human operator. in response to selecting the first routine, add a first text message to a security alert indicating whether the client system is subject to a computer security threat, the first text message determined according to a first message template selected according to the first routine; in response to selecting the second routine, add a second text message to the security alert, the second text message determined according to a second message template selected according to the second routine; and transmit the security alert to an administration device configured to display the security alert to a human operator.