24. A non-transitory computer-readable storage medium comprising executable instructions that, when executed by a computer system, cause the computer system to perform operations comprising: identifying, from a set of entities to be monitored, a subset of the set of entities for additional monitoring; performing the additional monitoring by: accessing a scoring rule that includes a search query, a triggering condition and a risk modifier, the scoring rule having been defined by information input via a user interface, the risk modifier indicative of an amount by which to adjust a risk score of a particular entity when the triggering condition is satisfied; after said accessing the scoring rule, executing the search query against a plurality of events associated with activity of the subset of the set of entities, wherein the search query produces a search result pertaining to activity of the particular entity, wherein each event of the plurality of events is associated with a timestamp and includes machine data; determining whether the search result meets the triggering condition; and responsive to determining that the search result meets the triggering condition: updating the risk score for the particular entity based on the risk modifier in the scoring rule; and providing a graphical user interface (GUI) for displaying an indication of the risk score associated with the particular entity of the subset of entities, the risk score indicating a security threat associated with activity of the particular entity.
24. A non-transitory computer-readable storage medium comprising executable instructions that, when executed by a computer system, cause the computer system to perform operations comprising: identifying, from a set of entities to be monitored, a subset of the set of entities for additional monitoring; performing the additional monitoring by: accessing a scoring rule that includes a search query, a triggering condition and a risk modifier, the scoring rule having been defined by information input via a user interface, the risk modifier indicative of an amount by which to adjust a risk score of a particular entity when the triggering condition is satisfied; after said accessing the scoring rule, executing the search query against a plurality of events associated with activity of the subset of the set of entities, wherein the search query produces a search result pertaining to activity of the particular entity, wherein each event of the plurality of events is associated with a timestamp and includes machine data; determining whether the search result meets the triggering condition; and responsive to determining that the search result meets the triggering condition: updating the risk score for the particular entity based on the risk modifier in the scoring rule; and providing a graphical user interface (GUI) for displaying an indication of the risk score associated with the particular entity of the subset of entities, the risk score indicating a security threat associated with activity of the particular entity. 28. The computer-readable non-transitory storage medium of claim 24 , wherein the plurality of events comprise web proxy events, and the activity of the particular entity is associated with transferring data to a domain external to an organization.