19. The apparatus of claim 14 , further comprising: a user input receiver, implemented at least partially by hardware, that receives an input corresponding to a selection of a particular identified accessed domain name; wherein the display processor causes display of additional detail pertaining to events in the set of events that included the particular identified accessed domain name.
14. An apparatus, comprising: an event extraction device, implemented at least partially by hardware, that extracts a set of accessed domain names from a set of events stored in a field-searchable data store; a domain name evaluation device, implemented at least partially by hardware, that identifies a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar; a registration time comparison device, implemented at least partially by hardware, that identifies a subset of accessed domain names in the set of accessed domain names for which the identified respective registration time of each accessed domain name in the subset is recent relative to times for other accessed domain names in the set of accessed domain names; a domain name access counter device, implemented at least partially by hardware, that determines, for each accessed domain name in the subset, an access count corresponding to how many times the set of events indicates that the accessed domain name in the subset was accessed; a display processor, implemented at least partially by hardware, that causes display of information relating to the access count corresponding to each accessed domain name in the subset.