Finding Needles in the Haystack of Security Events