A method of determining that an event is associated with a security violation, wherein: the event is associated with a monitored computing device; the event is associated with event data comprising command-line text ; the command-line text comprises a plurality of characters ; and the method comprises: sequentially providing characters of the plurality of characters to a trained representation mapping to determine respective representation vectors ; determining , for each character of the plurality of characters , a respective indicator at least partly by applying the respective representation vector to a trained classifier ; locating at least one token in the command-line text based at least in part on the respective indicators of the characters in the command-line text , the or each token being a contiguous sequence of adjacent characters having a particular UNICODE General Category, adjacent at both ends to a character of a different General Category or a string boundary with respect to each other or with respect to characters preceding or following the token ; and determining that the event is associated with a security violation based at least in part on the at least one token satisfying a stored token-security criterion . the event is associated with a monitored computing device; the event is associated with event data comprising command-line text ; the command-line text comprises a plurality of characters ; and the method comprises: sequentially providing characters of the plurality of characters to a trained representation mapping to determine respective representation vectors ; determining , for each character of the plurality of characters , a respective indicator at least partly by applying the respective representation vector to a trained classifier ; locating at least one token in the command-line text based at least in part on the respective indicators of the characters in the command-line text , the or each token being a contiguous sequence of adjacent characters having a particular UNICODE General Category, adjacent at both ends to a character of a different General Category or a string boundary with respect to each other or with respect to characters preceding or following the token ; and determining that the event is associated with a security violation based at least in part on the at least one token satisfying a stored token-security criterion . sequentially providing characters of the plurality of characters to a trained representation mapping to determine respective representation vectors ; determining , for each character of the plurality of characters , a respective indicator at least partly by applying the respective representation vector to a trained classifier ; locating at least one token in the command-line text based at least in part on the respective indicators of the characters in the command-line text , the or each token being a contiguous sequence of adjacent characters having a particular UNICODE General Category, adjacent at both ends to a character of a different General Category or a string boundary with respect to each other or with respect to characters preceding or following the token ; and determining that the event is associated with a security violation based at least in part on the at least one token satisfying a stored token-security criterion . <EOS>