computing commonality baseline metadata records based on multiple time windows;

filtering a first set of endpoint metadata records to identify a subset of metadata records, wherein filtering includes identifying, via machine learning, a delta between the first set of endpoint security metadata records and the commonality baseline metadata records;

based on the filtering designating the subset of metadata records as indicating a potential security threat, wherein designating includes designating the subset of metadata records for human analysis;

identifying command line operations within the endpoint metadata records; and

tokenizing the command line operations into a token, wherein the token is assigned a numerical value.