Efficient and refinable attack investigation