Patent ID: 8087087
Filing Date: 2011-12-27
Classification: H04L

Abstract:
1. A method for managing system events in a network, comprising: receiving, by a computer, a system event initiated by an initiating client associated with a user, wherein the system event comprises a plurality of data elements associated with respective ones of a plurality of system event attributes; evaluating the plurality of data elements of the system event against a security policy and determining that the system event fails to conform to the security policy for the user, wherein the security policy defines permitted actions for different users in accordance with the plurality of system event attributes; determining a greatest of a plurality of significance factors assigned to a plurality of data groups that are associated with the plurality of data elements of the system event; determining whether the system event matches a special attention rule in accordance with the plurality of data elements, wherein the special attention rule defines a prohibited action; if the system event does not match the special attention rule and the system event fails the security policy, assigning to the system event the greatest of the plurality of significance factors as a severity level; and if the system event matches the special attentions rule and the system event fails the security policy,