1. A computer-implemented method comprising: operating at least one processor on the computer to perform a method comprising: implementing an event detection system on a computer by at least: identifying at least one computer characteristic selected from the group consisting of computer entry points, data streams, computer events, and computer activity occurring on the computer; and generating metrics based on the identified at least one computer characteristic; implementing anti-malware services on the computer by at least: observing an event occurring on the computer; determining whether the observed event is a positive indicator of a malware infection; and responsive to a determination that the observed event is not a positive indicator of a malware infection: determining whether the observed event is potentially indicative of malware; and responsive to a determination that the observed event is potentially indicative of malware, reporting the observed event to an aggregation routine; and implementing the aggregation routine on the computer by at least: analyzing the metrics generated by the event detection system to identify a first suspicious event; receiving a report of a second suspicious event from at least one anti-malware service of the anti-malware services; identifying a combination of suspicious events, the combination of suspicious events comprising the first suspicious event and the second suspicious event; determining whether the combination of suspicious events is indicative of malware; and responsive to a determination that the combination of suspicious events is indicative of malware, marking an entity associated with the suspicious events in the combination of suspicious events as a malware entity, and applying a restrictive security policy that alters operation of the computer.