1. A method comprising: selecting, from a repository, a set of collections of forecasted feature vectors for a future time window after a present time, a cyber-attack being in progress in a data processing environment at the present time, a collection in the set having feature vectors that are indicative of an event related to the cyber-attack in a region of the environment at a discrete time; classifying the events corresponding to the collections in the set into a class of cyber-attack; determining, from a mapping between a set of phases of the cyber-attack and a set of classes, a phase that corresponds to the class; predicting the determined phase as likely to occur during the future time window in the region; selecting, from the repository, a past set of collections of actual feature vectors for a past time window before the present time, a cyber-attack being in progress in a data processing environment during the past time window, a collection in the past set having feature vectors that are indicative of a past event related to the cyber-attack in the region of the environment a past discrete time; classifying the events corresponding to the collections in the past set into a past class of cyber-attack; determining, from the mapping, a past phase that corresponds to the past class; and outputting the determined past phase as having occurred during the past time window in the region.