6. A processor-implemented method to execute on one or more processors that perform the method, comprising: receiving an indication that a context associated with a source of an event is malicious, wherein the context includes information about an environment surrounding an interaction between a corresponding event and one or more functions provided by an application at a point-in-time, and wherein the event is an action capable of being monitored and recorded within a computer; generating a context taint to identify the context as a tainted context that is malicious when the context has not been previously known to be malicious; transforming the event from an unmarked event to a tainted event by marking the unmarked event with the context taint; marking a prior unmarked context associated with the tainted event with the taint to create a prior tainted context, so as to propagate the taint from the tainted context to the prior tainted context, propagation of the taint being time-limited; marking any subsequent context linked to the prior tainted context by the tainted event or other events, as subsequent tainted contexts, so as to propagate the taint from the tainted context, to the prior tainted context, and then to the subsequent tainted contexts, propagation of the taint being time-limited; marking any other unmarked event emanating from the tainted context, the prior tainted context, or the subsequent tainted contexts as other tainted events with the taint; and publishing an event horizon to a display, the event horizon including the tainted event and all of the other tainted events.
11. The method of claim 6 , wherein the transforming further comprises: applying the taint as a value that travels with the tainted event.