Abstract: A method, including collecting, during a time period from multiple computers, reports of events, each of the events including communication activity performed by a process having a respective ID and executing on one of the computers. Respective sets of features including characteristics of the activity are generated from the reports, and a model is trained for identifying, based on the features of one or more of the events, the ID of one of the processes performing the one or more of the events. An alert indicating malicious activity and referencing one or more reports of additional communication events performed by a given computer is received from a network management device, and the model is applied to the one or more reports so as to identify, on the given computer, a given ID of a given process responsible for the alert. Finally, a protective action is initiated for the given process.