1. A system, comprising: an interface to receive an unmarked event, wherein an event is an action capable of being monitored and recorded within a computer system with one or more corresponding contexts for the event, the one or more corresponding contexts including information about an environment surrounding an interaction between a corresponding event and one or more functions provided by an application at a point-in-time; at least one processor to: transform the unmarked event into a tainted event by marking the unmarked event with a taint; mark the one or more corresponding contexts for the event as tainted contexts using the taint; mark a prior unmarked context associated with the tainted event with the taint to create a prior tainted context, so as to propagate the taint from the tainted context to the prior tainted context, propagation of the taint being time-limited; mark any subsequent context linked to the prior tainted context by the tainted event or other events, as subsequent tainted contexts, so as to propagate the taint from the tainted context to the prior tainted context and then to the subsequent tainted contexts, propagation of the taint being time-limited; and mark any other unmarked event emanating from the tainted contexts, the prior tainted context, or the subsequent tainted contexts as other tainted events with the taint; and a display to publish an event horizon as part of a graphical user interface (GUI) executed by a client node, the event horizon including the tainted event and all of the other tainted events.