A computerized system for detection of an emerging security-related issue, the system comprising: a processor; and computer storage memory having computer-executable instructions stored thereon which, when executed by the processor, implement a method comprising: receiving indications of a plurality of security-related events, each of the plurality of security-related events having an associated event time; determining a plurality of features for each of the plurality of security-related events; determining a similarity metric characterizing a similarity of the plurality of features for the plurality of security-related events; determining an emerging security-related issue; and providing a notification that indicates the emerging security-related issue; characterized in that the implemented method further comprises: utilizing the similarity metric to determine a plurality of potentially bursting clusters, PBCs, each of the plurality of PBCs including at least a portion of the plurality of security-related events and having a bursting likelihood score that represents a temporal frequency associated with event times of the portion of the plurality of security-related events included in the PBC; aggregating at least a portion of the plurality of PBCs to form aggregated PBCs, based on at least one intersection of portions of the plurality of security-related events included in the aggregated PBCs, to form at least one bursting cluster; and ranking the at least one bursting cluster based on its bursting likelihood score; and in that determining the emerging security-related issue comprises determining an emerging security-related issue associated with the portion of the security-related events included in a highest-ranked bursting cluster of the ranked at least one bursting cluster. a processor; and computer storage memory having computer-executable instructions stored thereon which, when executed by the processor, implement a method comprising: receiving indications of a plurality of security-related events, each of the plurality of security-related events having an associated event time; determining a plurality of features for each of the plurality of security-related events; determining a similarity metric characterizing a similarity of the plurality of features for the plurality of security-related events; determining an emerging security-related issue; and providing a notification that indicates the emerging security-related issue; receiving indications of a plurality of security-related events, each of the plurality of security-related events having an associated event time; determining a plurality of features for each of the plurality of security-related events; determining a similarity metric characterizing a similarity of the plurality of features for the plurality of security-related events; determining an emerging security-related issue; and providing a notification that indicates the emerging security-related issue; characterized in that the implemented method further comprises: utilizing the similarity metric to determine a plurality of potentially bursting clusters, PBCs, each of the plurality of PBCs including at least a portion of the plurality of security-related events and having a bursting likelihood score that represents a temporal frequency associated with event times of the portion of the plurality of security-related events included in the PBC; aggregating at least a portion of the plurality of PBCs to form aggregated PBCs, based on at least one intersection of portions of the plurality of security-related events included in the aggregated PBCs, to form at least one bursting cluster; and ranking the at least one bursting cluster based on its bursting likelihood score; and utilizing the similarity metric to determine a plurality of potentially bursting clusters, PBCs, each of the plurality of PBCs including at least a portion of the plurality of security-related events and having a bursting likelihood score that represents a temporal frequency associated with event times of the portion of the plurality of security-related events included in the PBC; aggregating at least a portion of the plurality of PBCs to form aggregated PBCs, based on at least one intersection of portions of the plurality of security-related events included in the aggregated PBCs, to form at least one bursting cluster; and ranking the at least one bursting cluster based on its bursting likelihood score; and in that determining the emerging security-related issue comprises determining an emerging security-related issue associated with the portion of the security-related events included in a highest-ranked bursting cluster of the ranked at least one bursting cluster.