A method (300, 400) of determining that a first event of a plurality of events is associated with a security violation, wherein: the plurality of events further includes a second event associated with a security violation; the first event is associated with a monitored computing device; each event of the plurality of events is associated with a respective command-line record (306, 308); and the method comprises: for each event of the plurality of events, determining a respective event vector (316, 318) based at least in part on at least a portion of the respective command-line record and on a trained representation mapping, wherein each event vector represents the respective event and has a first number of elements; determining a respective reduced event vector (324, 326) for each of the respective event vectors, wherein each reduced event vector has a second number of elements smaller than the first number of elements; clustering the reduced event vectors to determine a respective cluster identifier (330, 332) for each of the reduced event vectors, wherein the first event is associated with a first cluster identifier and the second event is associated with a second cluster identifier; and determining that the first event is associated with a security violation based at least in part on the first cluster identifier matching the second cluster identifier. the plurality of events further includes a second event associated with a security violation; the first event is associated with a monitored computing device; each event of the plurality of events is associated with a respective command-line record (306, 308); and the method comprises: for each event of the plurality of events, determining a respective event vector (316, 318) based at least in part on at least a portion of the respective command-line record and on a trained representation mapping, wherein each event vector represents the respective event and has a first number of elements; determining a respective reduced event vector (324, 326) for each of the respective event vectors, wherein each reduced event vector has a second number of elements smaller than the first number of elements; clustering the reduced event vectors to determine a respective cluster identifier (330, 332) for each of the reduced event vectors, wherein the first event is associated with a first cluster identifier and the second event is associated with a second cluster identifier; and determining that the first event is associated with a security violation based at least in part on the first cluster identifier matching the second cluster identifier. for each event of the plurality of events, determining a respective event vector (316, 318) based at least in part on at least a portion of the respective command-line record and on a trained representation mapping, wherein each event vector represents the respective event and has a first number of elements; determining a respective reduced event vector (324, 326) for each of the respective event vectors, wherein each reduced event vector has a second number of elements smaller than the first number of elements; clustering the reduced event vectors to determine a respective cluster identifier (330, 332) for each of the reduced event vectors, wherein the first event is associated with a first cluster identifier and the second event is associated with a second cluster identifier; and determining that the first event is associated with a security violation based at least in part on the first cluster identifier matching the second cluster identifier.