1. A non-transitory computer-readable medium storing computer-readable instructions that, when read by a computing device, cause the computing device to: determine that a data security event or a data logging event occurs at an application running on a computing domain; in response to determining that the data security event or the data logging event occurs at the application running on the computing domain, determine that the application uses a first concept name from an application dictionary associated with the application to describe the data security event or the data logging event; generate an entry for the data security event or the data logging event and add the entry to a data log for the application running on the computing domain, wherein the entry includes the first concept name from the application dictionary associated with the application; determine that the first concept name from the application dictionary corresponds to a second concept name from a domain dictionary associated with a plurality of applications running on the computing domain; and generate a mapping of the first concept name from the application dictionary to the second concept name from the domain dictionary associated with the plurality of applications running on the computing domain.
3. The non-transitory computer-readable medium of claim 1 , wherein generating the mapping comprises generating a mapping file that identifies the domain dictionary, the first concept name from the application dictionary, and a concept identifier for the data security event or the data logging event.