In some examples, event data 122 about events detected or observed locally on a client device 104 can be processed locally by a compute engine 102 and/or other elements of a local security agent 108 executing on that client device 104. However, in some examples, event data 122 about locally-occurring events can also, or alternately, be sent by a security agent 108 on a client device 104 to the security network 106, such that the event data 122 can be processed by a cloud instance of the compute engine 102 and/or other cloud elements of the distributed security system 100. Accordingly, event data 122 about events that occur locally on client devices 104 can be processed locally by security agents 108, be processed remotely via cloud elements of the distributed security system 100, or be processed by both local security agents 108 and cloud elements of the distributed security system 100.