Toolkit for analysts with interactive visualizations for identifying patterns in raw events, just six operations providing full expressivity and fine-grained control, and an incremental query engine to seamlessly trade between query precision, speed and cost.