A system comprising: one or more processors; and programming instructions configured to be executed by the one or more processors to perform operations comprising: receiving, from a monitored computing device, data associated with events detected at the monitored computing device, wherein the events are produced by at least one process or at least one thread, individual events of the events having respective event types; determining a plurality of the events from the data during a time interval; identifying patterns within the plurality of the events based at least in part on the patterns meeting a first predetermined criterion; determining pattern scores associated with the patterns based at least in part on respective relative frequencies of occurrence of the patterns; determining a composite score for the plurality of the events based at least in part on the pattern scores; determining that the plurality of the events is associated with an incident indicating malicious activity based at least in part on the composite score; and tagging the associated plurality of events as an incident indicating malicious activity, wherein meeting a first predetermined criterion comprises: determining a distribution of event types within the patterns; and determining that the patterns are associated with targeted activity based at least in part on the determined distribution. one or more processors; and programming instructions configured to be executed by the one or more processors to perform operations comprising: receiving, from a monitored computing device, data associated with events detected at the monitored computing device, wherein the events are produced by at least one process or at least one thread, individual events of the events having respective event types; determining a plurality of the events from the data during a time interval; identifying patterns within the plurality of the events based at least in part on the patterns meeting a first predetermined criterion; determining pattern scores associated with the patterns based at least in part on respective relative frequencies of occurrence of the patterns; determining a composite score for the plurality of the events based at least in part on the pattern scores; determining that the plurality of the events is associated with an incident indicating malicious activity based at least in part on the composite score; and tagging the associated plurality of events as an incident indicating malicious activity, wherein meeting a first predetermined criterion comprises: determining a distribution of event types within the patterns; and determining that the patterns are associated with targeted activity based at least in part on the determined distribution. receiving, from a monitored computing device, data associated with events detected at the monitored computing device, wherein the events are produced by at least one process or at least one thread, individual events of the events having respective event types; determining a plurality of the events from the data during a time interval; identifying patterns within the plurality of the events based at least in part on the patterns meeting a first predetermined criterion; determining pattern scores associated with the patterns based at least in part on respective relative frequencies of occurrence of the patterns; determining a composite score for the plurality of the events based at least in part on the pattern scores; determining that the plurality of the events is associated with an incident indicating malicious activity based at least in part on the composite score; and tagging the associated plurality of events as an incident indicating malicious activity, wherein meeting a first predetermined criterion comprises: determining a distribution of event types within the patterns; and determining that the patterns are associated with targeted activity based at least in part on the determined distribution. determining a distribution of event types within the patterns; and determining that the patterns are associated with targeted activity based at least in part on the determined distribution.