A complex event processing system comprising: an event harvesting system operable to monitor a computer network (10, 21, 22, 31, 32, 33), said event harvesting system comprising a head end node including an interface for receiving configuration instructions from a user of the system, said head end node being arranged in operation to process said configuration instructions; a complex event processing engine, associated with the head end node, arranged in operation to process received simple event reports to identify the occurrence of complex events; said complex event processing system being characterised by: the event harvesting system further comprising a plurality of capture node modules (41, 42), each of said capture node modules being deployed onto a legacy network and being operatively connected to the head end node (51,53) by a network connection; the head end node being further arranged in operation to send the configuration instructions to a specified capture node module to specify what simple event reports are to be generated by the capture node module (41, 42) and in response to what conditions detected on the monitored computer network; each of said capture node modules being operable to: a) receive, from the head end node, configuration instructions for causing the capture node module to operate in accordance with the configuration instructions; and b) in response to the result of monitoring the network, generate the simple event reports specified in the received configuration instructions and pass these to the complex event processing engine. an event harvesting system operable to monitor a computer network (10, 21, 22, 31, 32, 33), said event harvesting system comprising a head end node including an interface for receiving configuration instructions from a user of the system, said head end node being arranged in operation to process said configuration instructions; a complex event processing engine, associated with the head end node, arranged in operation to process received simple event reports to identify the occurrence of complex events; said complex event processing system being characterised by: the event harvesting system further comprising a plurality of capture node modules (41, 42), each of said capture node modules being deployed onto a legacy network and being operatively connected to the head end node (51,53) by a network connection; the head end node being further arranged in operation to send the configuration instructions to a specified capture node module to specify what simple event reports are to be generated by the capture node module (41, 42) and in response to what conditions detected on the monitored computer network; each of said capture node modules being operable to: a) receive, from the head end node, configuration instructions for causing the capture node module to operate in accordance with the configuration instructions; and b) in response to the result of monitoring the network, generate the simple event reports specified in the received configuration instructions and pass these to the complex event processing engine. the event harvesting system further comprising a plurality of capture node modules (41, 42), each of said capture node modules being deployed onto a legacy network and being operatively connected to the head end node (51,53) by a network connection; the head end node being further arranged in operation to send the configuration instructions to a specified capture node module to specify what simple event reports are to be generated by the capture node module (41, 42) and in response to what conditions detected on the monitored computer network; each of said capture node modules being operable to: a) receive, from the head end node, configuration instructions for causing the capture node module to operate in accordance with the configuration instructions; and b) in response to the result of monitoring the network, generate the simple event reports specified in the received configuration instructions and pass these to the complex event processing engine. a) receive, from the head end node, configuration instructions for causing the capture node module to operate in accordance with the configuration instructions; and b) in response to the result of monitoring the network, generate the simple event reports specified in the received configuration instructions and pass these to the complex event processing engine.