1. A network security system comprising: a computation engine implemented using Apache Storm or Apache Spark Streaming, configured to receive first event data indicative of activity on a computer network, to detect first indicia of possible security breaches in a real-time processing mode based on the first event data, and to generate real-time analysis result data representing the first indicia; a non-volatile storage system to store the real-time analysis result data and second event data indicative of activity on the computer network; and an Apache Spark cluster computing engine operatively coupled to the computation engine and the non-volatile storage system, the Apache Spark cluster computing engine further configured to retrieve, from the non-volatile storage system, the real-time analysis result data and the second event data, and to detect, in a batch mode, second indicia of possible security breaches based on the second event data and the real-time analysis result data.