Abstract: System, methods, and apparatuses enable a network security system to more efficiently process system events. For example, the disclosed approaches may be used to improve the way in which a security service processes events (e.g., network traffic, files, email messages, etc.) in order to detect various types of network security threats (e.g., network intrusion attempts, viruses, spam, and other potential network security issues).