A method of processing status messages for use in network security management in respect of a network of computing devices, the status messages each comprising information relating to the network, information relating to at least one of said computing devices therein, or information relating to an event that has been detected by or in respect of the network or detected by or in respect of at least one of said computing devices therein, the information of which a status message is comprised comprising data relating to a plurality of attributes of said network, said at least one computing device, or said event; the method comprising one or more processors performing steps of: filtering received status messages according to filtering rules (32, 34) in order to identify, in dependence on one or more attributes of said status messages: (i) status messages indicative of potential or actual network security events in respect of which a predetermined response is deemed applicable; (ii) status messages in respect of which a null response is deemed applicable; and (iii) residue messages in respect of which the filtering rules neither indicate that a predetermined response is deemed applicable, nor indicate that a null response is deemed applicable; processing received status messages identified as status messages indicative of potential or actual network security events in respect of which a predetermined response is deemed applicable, such that a predetermined response may be initiated; characterised in that the method further comprises: in respect of one or more received status messages identified as residue messages, subjecting the one or more residue messages to analysis involving clustering in dependence on one or more attributes thereof; and updating the filtering rules for use in subsequent filtering of received status messages using an automated updating procedure dependent on one or more results of the analysis (s75, s76). filtering received status messages according to filtering rules (32, 34) in order to identify, in dependence on one or more attributes of said status messages: (i) status messages indicative of potential or actual network security events in respect of which a predetermined response is deemed applicable; (ii) status messages in respect of which a null response is deemed applicable; and (iii) residue messages in respect of which the filtering rules neither indicate that a predetermined response is deemed applicable, nor indicate that a null response is deemed applicable; (i) status messages indicative of potential or actual network security events in respect of which a predetermined response is deemed applicable; (ii) status messages in respect of which a null response is deemed applicable; and (iii) residue messages in respect of which the filtering rules neither indicate that a predetermined response is deemed applicable, nor indicate that a null response is deemed applicable; processing received status messages identified as status messages indicative of potential or actual network security events in respect of which a predetermined response is deemed applicable, such that a predetermined response may be initiated; characterised in that the method further comprises: in respect of one or more received status messages identified as residue messages, subjecting the one or more residue messages to analysis involving clustering in dependence on one or more attributes thereof; and updating the filtering rules for use in subsequent filtering of received status messages using an automated updating procedure dependent on one or more results of the analysis (s75, s76). in respect of one or more received status messages identified as residue messages, subjecting the one or more residue messages to analysis involving clustering in dependence on one or more attributes thereof; and updating the filtering rules for use in subsequent filtering of received status messages using an automated updating procedure dependent on one or more results of the analysis (s75, s76).