Reveal converts search strings to lowercase, removes punctuation, and removes common stop words, such as articles. Reveal then searches for the exact sequence of tokens across the environment. For example, if a search query is process is started, this is tokenized as ["process","started"]. These tokens match the malicious process has started , but not started the process because the tokens are not in the same order as the query.