Provexa is a security analysis tool that empowers human analysts to investigate complex multi-step attacks over large-scale system provenance data using an expressive domain-specific language (ProvQL) and a high-performance execution engine.