A method of determining that an event is associated with a security violation, wherein: the event is associated with a monitored computing device; the event is associated with event data comprising command-line text; the command-line text comprises a plurality of characters; and the method comprises: sequentially providing characters of the plurality of characters to a trained representation mapping to determine respective representation vectors; determining, for each character of the plurality of characters, a respective indicator at least partly by applying the respective representation vector to a trained classifier; locating at least one token in the command-line text based at least in part on the respective indicators of the characters in the command-line text, the or each token being a contiguous sequence of adjacent characters having a particular UNICODE General Category, adjacent at both ends to a character of a different General Category or a string boundary with respect to each other or with respect to characters preceding or following the token; and determining that the event is associated with a security violation based at least in part on the at least one token satisfying a stored token-security criterion. the event is associated with a monitored computing device; the event is associated with event data comprising command-line text; the command-line text comprises a plurality of characters; and the method comprises: sequentially providing characters of the plurality of characters to a trained representation mapping to determine respective representation vectors; determining, for each character of the plurality of characters, a respective indicator at least partly by applying the respective representation vector to a trained classifier; locating at least one token in the command-line text based at least in part on the respective indicators of the characters in the command-line text, the or each token being a contiguous sequence of adjacent characters having a particular UNICODE General Category, adjacent at both ends to a character of a different General Category or a string boundary with respect to each other or with respect to characters preceding or following the token; and determining that the event is associated with a security violation based at least in part on the at least one token satisfying a stored token-security criterion. sequentially providing characters of the plurality of characters to a trained representation mapping to determine respective representation vectors; determining, for each character of the plurality of characters, a respective indicator at least partly by applying the respective representation vector to a trained classifier; locating at least one token in the command-line text based at least in part on the respective indicators of the characters in the command-line text, the or each token being a contiguous sequence of adjacent characters having a particular UNICODE General Category, adjacent at both ends to a character of a different General Category or a string boundary with respect to each other or with respect to characters preceding or following the token; and determining that the event is associated with a security violation based at least in part on the at least one token satisfying a stored token-security criterion.