Abstract: Utilities for data network monitoring for identification of security threats and other occurrences of interest and analytical tools for selecting actions to be taken to reduce further harm or vulnerability. Log message data (e.g., log messages, alerts, etc.) may be enriched with supplemental information related to an identity (e.g., user) that is not initially present in the log message data, but which may be beneficial in generating events and identifying appropriate response actions.