Abstract: Methods, systems, and computer storage media for providing observation stream data of security incidents using an observation stream engine in a security management system. An observation stream framework supports continuously generating and presenting observation stream data that facilitates developing a working hypothesis of an active security incident. The observation stream framework can also include observation stream query-types that can be selected for running queries against a plurality of security data sources. In operation, an observation stream query is accessed. The observation stream query is a user-generated observation stream query associated with an observation stream query-type. The observation stream query-type comprises parameters for querying a plurality of security data sources and dynamic tracking of a security incident. The observation stream query is executed and observation stream data is generated.

Abstract: The handling of protocol exceptions for deterministic code that communicates with external component(s). A protocol exception host updates an execution state object associated with the deterministic code as the execution of the deterministic code proceeds. The component also detects whether a protocol exception has occurred that was caused by the deterministic code communicating using the protocol with an external component. If the component detects that such a protocol exception has occurred, the component handles the protocol exception. The component also determines whether the handled protocol exception has been successfully handled. If the exception is not successfully handled, the component stops the execution of the deterministic code such that the execution state object includes execution state of the deterministic code up to the stop. Accordingly, the execution state of the deterministic code up to the stop may be later used to resume execution of the deterministic code.