A method for determining redundant discrete raw alerts 220 from unstructured data-in-transit, the method to be performed by a computer system comprising: generating a movable variable sized time window 212 and using the movable variable sized time window 212 to encompass a first set of discrete raw alerts 220 in the unstructured data-in-transit, wherein the data-in-transit are arranged in a chronological order, and wherein each discrete raw alert comprises a data component and a time component; generating a digital signature for each discrete raw alert encompassed within the variable sized time window 212 using the data component contained in each discrete raw alert; processing the generated digital signatures, the processing of each generated digital signature comprises: matching a generated digital signature with digital signatures stored in a meta-definition database, if the generated digital signature matches with digital signatures stored in the meta-definition database, adding the matched digital signature to a severity threshold database, and if the generated digital signature does not match digital signatures stored in the meta-definition database, adding unmatched digital signatures to the meta-definition database, whereby, for digital signatures in the severity threshold database that have incident counts exceeding a predetermined incident count threshold, marking such digital signatures as redundant digital signatures and marking raw alerts 220 associated with redundant digital signatures as redundant raw alerts 220; and marking raw alerts 220 having unmatched digital signatures as non-redundant raw alerts 220, and aggregating, compressing and encrypting non-redundant raw alerts 220, wherein the generating the movable variable sized time window 212 comprises dynamically changing a size of the movable variable sized time window 212, wherein the size of the movable variable sized time window 212 is increased if a ratio of non-redundant raw alerts 220 to redundant raw alerts 220 is higher than a predetermined ratio. generating a movable variable sized time window 212 and using the movable variable sized time window 212 to encompass a first set of discrete raw alerts 220 in the unstructured data-in-transit, wherein the data-in-transit are arranged in a chronological order, and wherein each discrete raw alert comprises a data component and a time component; generating a digital signature for each discrete raw alert encompassed within the variable sized time window 212 using the data component contained in each discrete raw alert; processing the generated digital signatures, the processing of each generated digital signature comprises: matching a generated digital signature with digital signatures stored in a meta-definition database, if the generated digital signature matches with digital signatures stored in the meta-definition database, adding the matched digital signature to a severity threshold database, and if the generated digital signature does not match digital signatures stored in the meta-definition database, adding unmatched digital signatures to the meta-definition database, whereby, for digital signatures in the severity threshold database that have incident counts exceeding a predetermined incident count threshold, marking such digital signatures as redundant digital signatures and marking raw alerts 220 associated with redundant digital signatures as redundant raw alerts 220; and marking raw alerts 220 having unmatched digital signatures as non-redundant raw alerts 220, and aggregating, compressing and encrypting non-redundant raw alerts 220, matching a generated digital signature with digital signatures stored in a meta-definition database, if the generated digital signature matches with digital signatures stored in the meta-definition database, adding the matched digital signature to a severity threshold database, and if the generated digital signature does not match digital signatures stored in the meta-definition database, adding unmatched digital signatures to the meta-definition database, whereby, for digital signatures in the severity threshold database that have incident counts exceeding a predetermined incident count threshold, marking such digital signatures as redundant digital signatures and marking raw alerts 220 associated with redundant digital signatures as redundant raw alerts 220; and marking raw alerts 220 having unmatched digital signatures as non-redundant raw alerts 220, and aggregating, compressing and encrypting non-redundant raw alerts 220,