1. A method, comprising: extracting a set of accessed domain names from a set of events stored in a field-searchable data store; identifying a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar; identifying a subset of accessed domain names in the set of accessed domain names that have a respective registration time that meets a first criterion; determining, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed; performing an action for each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion according to one or more rules associated with the accessed domain name, wherein the one or more rules include causing an alert to be generated and transmitted that identifies the accessed domain name and that the accessed domain name was accessed; wherein the method is performed by one or more computing devices.
1. A method, comprising: extracting a set of accessed domain names from a set of events stored in a field-searchable data store; identifying a respective registration time for each accessed domain name in the set of accessed domain names, wherein the respective registration time is indicative of when the accessed domain name was registered with a registrar; identifying a subset of accessed domain names in the set of accessed domain names that have a respective registration time that meets a first criterion; determining, for each accessed domain name in the subset of accessed domain names, an associated access count corresponding to how many times the set of events indicates that the accessed domain name was accessed; performing an action for each accessed domain name in the subset of accessed domain names that has an associated access count that meets a second criterion according to one or more rules associated with the accessed domain name, wherein the one or more rules include causing an alert to be generated and transmitted that identifies the accessed domain name and that the accessed domain name was accessed; wherein the method is performed by one or more computing devices. 2. The method of claim 1 , wherein the one or more rules include blocking access to the accessed domain name.