1. A method of capturing data relating to a threat, wherein the method includes, in a server processing system: receiving event history data that comprises a sequential chain of one or more events performed by a client processing system, wherein performance of the one or more events in the sequential chain of one or more events leads to a trigger event, and wherein the sequential chain of one or more events is associated with the threat; upon detecting the trigger event, suspending performance of one or more further events from the threat, wherein a second chain of events comprises the sequential chain of one or more events and the one or more further events, the one or more further events configured to execute subsequent to the trigger event in the second chain of events; receiving the trigger event that occurred in the client processing system, wherein the server processing system receives the event history data in response to the client processing system detecting the trigger event, the trigger event comprising a level of threat, wherein the level of threat includes a value to indicate a probability of the trigger event posing a threat to the client processing system; determining whether the level of threat satisfies a predetermined threshold; upon determining the level of threat satisfies the predetermined threshold, permitting the one or more further events to be performed by the client processing system subsequent to the occurrence of the trigger event in order to capture additional data regarding the threat; analyzing the events in the sequential chain of one or more events in a reverse order to determine a starting point for the sequential chain of one or more events, wherein analyzing the events in the reverse order comprises analyzing the events in the reverse order that the events were added to the sequential chain of one or more events; comparing the event history data against past event history data received from a plurality of client processing systems in order to determine if the event history data and the past event history data comprise a series of common events; and identifying an entity associated with the series of common events.