Systems and methods for processing events are disclosed. Event data comprising passive event data, active event data, or both is received. It is determined whether the received event data is available for a pattern of passive event data and active event data. In response to determining that the received event data is available for the pattern of passive event data and active event data, one or more constraints between the passive event data and the active event data are converted into one or more query terms. The query terms are used to construct at least one query. Remaining passive event data that is related to some, but not all, of the active event data is obtained using the constructed at least one query.