1. A computer-implemented method performed by data processing apparatus, the method comprising: determining that a particular one of a plurality of tokens is included in one or more packets of network traffic; identifying a particular set of security checks corresponding to the particular token, the set of security checks including one or more security checks of a plurality of security checks, wherein each security check includes one or more security processes of a plurality of security processes, and each security process includes one or more security operations of a plurality of security operations, and wherein each security process corresponds to an alert condition satisfied based on results of the respective set of security operations; using a data structure mapping of security checks to security operations to identify for each security check in the particular set of security checks a respective set of processes, and for each security process in the set of security processes a respective set of security operations to be applied to data of the one or more packets, wherein a particular security operation is reused between at least two, but less than all, of the plurality of security checks, and the data structure includes a check data structure including entries for each of the security checks in the plurality of security checks, each security check entry referencing entries of a security process data structure corresponding to the set of security processes included in the respective security check, the security process data structure including, for each security process, a reference to entries of a security operation data structure corresponding to the set of security operations of the respective security process.