An interactive display system enables a user to compose a graph pattern for a temporal graph on a display screen. The system comprises a canvas that provides an interactive editing surface. The editor receives an input a set of user interactions, such as the drawing of lines and boxes, the specifying of attributes, and the like, that together compose a graph pattern. During the graph pattern composition, the user may retrieve other graph patterns (e.g., from a data store) and integrate them into the pattern being composed. Once the graph pattern is composed (or as it is being composed), the system converts the graphical pattern into a text-based representation, such as a computer program in a particular graph programming language, which is then used for subsequent processing and matching in a cybersecurity threat discovery workflow. The pattern (program code) also is stored to disk, from which it may be retrieved and converted back into its graphical view on the screen, e.g., for further editing and revision.