A method of determining that a first event of a plurality of events is associated with a security violation, wherein: the plurality of events further includes a second event associated with a security violation; the first event is associated with a monitored computing device; each event of the plurality of events is associated with a respective command-line record ; and the method comprises: for each event of the plurality of events, determining a respective event vector based at least in part on at least a portion of the respective command-line record and on a trained representation mapping , wherein each event vector represents the respective event and has a first number of elements; determining a respective reduced event vector for each of the respective event vectors, wherein each reduced event vector has a second number of elements smaller than the first number of elements; clustering the reduced event vectors to determine a respective cluster identifier for each of the reduced event vectors, wherein the first event is associated with a first cluster identifier and the second event is associated with a second cluster identifier; and determining that the first event is associated with a security violation based at least in part on the first cluster identifier matching the second cluster identifier . the plurality of events further includes a second event associated with a security violation; the first event is associated with a monitored computing device; each event of the plurality of events is associated with a respective command-line record ; and the method comprises: for each event of the plurality of events, determining a respective event vector based at least in part on at least a portion of the respective command-line record and on a trained representation mapping , wherein each event vector represents the respective event and has a first number of elements; determining a respective reduced event vector for each of the respective event vectors, wherein each reduced event vector has a second number of elements smaller than the first number of elements; clustering the reduced event vectors to determine a respective cluster identifier for each of the reduced event vectors, wherein the first event is associated with a first cluster identifier and the second event is associated with a second cluster identifier; and determining that the first event is associated with a security violation based at least in part on the first cluster identifier matching the second cluster identifier . for each event of the plurality of events, determining a respective event vector based at least in part on at least a portion of the respective command-line record and on a trained representation mapping , wherein each event vector represents the respective event and has a first number of elements; determining a respective reduced event vector for each of the respective event vectors, wherein each reduced event vector has a second number of elements smaller than the first number of elements; clustering the reduced event vectors to determine a respective cluster identifier for each of the reduced event vectors, wherein the first event is associated with a first cluster identifier and the second event is associated with a second cluster identifier; and determining that the first event is associated with a security violation based at least in part on the first cluster identifier matching the second cluster identifier . <EOS>