Abstract: Detection of unknown applications is disclosed, including: detecting an event associated with accessing an application; determining target information associated with the event; and identifying the application from the target information.

Abstract: Detection of unknown applications is disclosed, including: detecting an event associated with accessing an application; determining target information associated with the event; and identifying the application from the target information.

Abstract: Event stream-based threat detection is disclosed, including: determining that an event from a stream of events is an influencing event by comparing the event to an alert rule; storing a new cache entry associated with the influencing event in a detection cache, wherein the new cache entry includes a fingerprint associated with the influencing event; querying the detection cache using at least the fingerprint associated with the new cache entry for a set of related cache entries; and determining whether to generate an alert based at least in part on the set of related cache entries and the alert rule.