A method comprising: defining, at an ontology service of a security network, ontological definitions of: one or more context collection formats, wherein a context collection format defines one or more data elements for corresponding event data instances associated with occurrences of a type of event; and one or more context collection interfaces, wherein a context collection interface defines at least one data element to be processed in the security network; providing, at the ontology service, one or more interface fulfillment maps associated with corresponding pairings of the one or more context collections formats and the one or more context collection interfaces, wherein a particular interface fulfillment map: is associated with a pairing of a particular context collection format and a particular context collection interface, and identifies at least one portion of an event data instance, formatted according to the particular context collection format, that maps to the at least one data element defined in a particular context collection interface; generating, by a compiler of the security network, a configuration comprising compiled executable instructions that, when executed by one or more instances of a compute engine, causes the one or more instances of the compute engine to process event data associated with occurrences of events on one or more client devices according to: at least one context collection interface of the one or more context collection interfaces, and at least one interface fulfilment map, of the one or more interface fulfillment maps, corresponding to the at least one context collection interface; and providing, by the compiler, the configuration to the one or more instances of the compute engine. defining, at an ontology service of a security network, ontological definitions of: one or more context collection formats, wherein a context collection format defines one or more data elements for corresponding event data instances associated with occurrences of a type of event; and one or more context collection interfaces, wherein a context collection interface defines at least one data element to be processed in the security network; one or more context collection formats, wherein a context collection format defines one or more data elements for corresponding event data instances associated with occurrences of a type of event; and one or more context collection interfaces, wherein a context collection interface defines at least one data element to be processed in the security network; providing, at the ontology service, one or more interface fulfillment maps associated with corresponding pairings of the one or more context collections formats and the one or more context collection interfaces, wherein a particular interface fulfillment map: is associated with a pairing of a particular context collection format and a particular context collection interface, and identifies at least one portion of an event data instance, formatted according to the particular context collection format, that maps to the at least one data element defined in a particular context collection interface; generating, by a compiler of the security network, a configuration comprising compiled executable instructions that, when executed by one or more instances of a compute engine, causes the one or more instances of the compute engine to process event data associated with occurrences of events on one or more client devices according to: at least one context collection interface of the one or more context collection interfaces, and at least one interface fulfilment map, of the one or more interface fulfillment maps, corresponding to the at least one context collection interface; and providing, by the compiler, the configuration to the one or more instances of the compute engine. is associated with a pairing of a particular context collection format and a particular context collection interface, and identifies at least one portion of an event data instance, formatted according to the particular context collection format, that maps to the at least one data element defined in a particular context collection interface; generating, by a compiler of the security network, a configuration comprising compiled executable instructions that, when executed by one or more instances of a compute engine, causes the one or more instances of the compute engine to process event data associated with occurrences of events on one or more client devices according to: at least one context collection interface of the one or more context collection interfaces, and at least one interface fulfilment map, of the one or more interface fulfillment maps, corresponding to the at least one context collection interface; and providing, by the compiler, the configuration to the one or more instances of the compute engine. at least one context collection interface of the one or more context collection interfaces, and at least one interface fulfilment map, of the one or more interface fulfillment maps, corresponding to the at least one context collection interface; and providing, by the compiler, the configuration to the one or more instances of the compute engine.