Learning from experts’ experience: toward automated cyber security data triage