Online extremists in social networks pose a new form of threat to the general public. These extremists range from cyberbullies who harass innocent users to terrorist organizations such as the Islamic State of Iraq and Syria (ISIS) that use social networks to recruit and incite violence. Currently social networks suspend the accounts of such extremists in response to user complaints. The challenge is that these extremist users simply create new accounts and continue their activities. In this work we present a new set of operational capabilities to deal with the threat posed by online extremists in social networks. Using data from several hundred thousand extremist accounts on Twitter, we develop a behavioral model for these users, in particular what their accounts look like and who they connect with. This model is used to identify new extremist accounts by predicting if they will be suspended for extremist activity. We also use this model to track existing extremist users as they create new accounts by identifying if two accounts belong to the same user. Finally, we present a model for searching the social network to efficiently find suspended users' new accounts based on a variant of the classic Polya's urn setup. We find a simple characterization of the optimal search policy for this model under fairly general conditions. Our urn model and main theoretical results generalize easily to search problems in other fields.