A method for detecting computer attacks comprising: gathering, using a hardware processor, information on an object in a computer in a network; saving a security notification with the object in an object database in the network; searching for the object in a threat database in the network; adding one or more tags to the object when the object is found in the threat database and adding a correspondence between a record in the object database and the threat database; wherein the method is characterized by the steps of: searching for suspicious activity based on the one or more tags in a suspicious activity database; when a sign of suspicious activity is found in the suspicious activity database, adding a second tag to the security notification, the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity; and determining that a computer attack has occurred when the one or more tag and the second tag correspond to one or more signatures in a database of computer attacks, wherein a signature of the one or more signatures comprises: at least one record about the object, at least one record about the security notification, at least one tag of the object and at least one tag of the security notification. gathering, using a hardware processor, information on an object in a computer in a network; saving a security notification with the object in an object database in the network; searching for the object in a threat database in the network; adding one or more tags to the object when the object is found in the threat database and adding a correspondence between a record in the object database and the threat database; wherein the method is characterized by the steps of: searching for suspicious activity based on the one or more tags in a suspicious activity database; when a sign of suspicious activity is found in the suspicious activity database, adding a second tag to the security notification, the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity; and determining that a computer attack has occurred when the one or more tag and the second tag correspond to one or more signatures in a database of computer attacks, wherein a signature of the one or more signatures comprises: at least one record about the object, at least one record about the security notification, at least one tag of the object and at least one tag of the security notification. searching for suspicious activity based on the one or more tags in a suspicious activity database; when a sign of suspicious activity is found in the suspicious activity database, adding a second tag to the security notification, the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity; and determining that a computer attack has occurred when the one or more tag and the second tag correspond to one or more signatures in a database of computer attacks, wherein a signature of the one or more signatures comprises: at least one record about the object, at least one record about the security notification, at least one tag of the object and at least one tag of the security notification.