A computer-implemented method for generating rules for detecting and blocking attacks on electronics systems of a vehicle, comprising: receiving log data having a plurality of messages that have been intercepted on at least one communications bus between a plurality of electronic control units, ECU, of the vehicle and information on at least one ECU which is the recipient of at least one of the intercepted messages, wherein the plurality of messages have been intercepted during a period of time associated with a vehicle incident, the vehicle incident being an undesirable event resulting in a change to a behavior of the vehicle, including a road traffic accident; detecting a computer attack based on analysis of the received log data; in response to detecting the computer attack, determining indicators of compromise including a subset of the plurality of messages used in the computer attack, and for each message in the subset, determining information on the at least one ECU of the vehicle which is the recipient of that message; generating a rule for a protection module executing in a processor in the vehicle, based on the indicators of compromise, wherein the rule contains: at least one condition for the application of the rule for detecting a subsequent computer attack on the vehicle, the at least one condition further specifying a presence of a defined group of messages from the subset during a period of time associated with movement of the vehicle and a state of movement of the vehicle, such that the rule is applied responsive to determining that the vehicle is in motion, and the rule is not applied responsive to determining that the vehicle is not moving, the defined group of messages being arranged in a defined order, and at least one action upon application of the rule for blocking the subsequent computer attack on the vehicle. receiving log data having a plurality of messages that have been intercepted on at least one communications bus between a plurality of electronic control units, ECU, of the vehicle and information on at least one ECU which is the recipient of at least one of the intercepted messages, wherein the plurality of messages have been intercepted during a period of time associated with a vehicle incident, the vehicle incident being an undesirable event resulting in a change to a behavior of the vehicle, including a road traffic accident; detecting a computer attack based on analysis of the received log data; in response to detecting the computer attack, determining indicators of compromise including a subset of the plurality of messages used in the computer attack, and for each message in the subset, determining information on the at least one ECU of the vehicle which is the recipient of that message; generating a rule for a protection module executing in a processor in the vehicle, based on the indicators of compromise, wherein the rule contains: at least one condition for the application of the rule for detecting a subsequent computer attack on the vehicle, the at least one condition further specifying a presence of a defined group of messages from the subset during a period of time associated with movement of the vehicle and a state of movement of the vehicle, such that the rule is applied responsive to determining that the vehicle is in motion, and the rule is not applied responsive to determining that the vehicle is not moving, the defined group of messages being arranged in a defined order, and at least one action upon application of the rule for blocking the subsequent computer attack on the vehicle. at least one condition for the application of the rule for detecting a subsequent computer attack on the vehicle, the at least one condition further specifying a presence of a defined group of messages from the subset during a period of time associated with movement of the vehicle and a state of movement of the vehicle, such that the rule is applied responsive to determining that the vehicle is in motion, and the rule is not applied responsive to determining that the vehicle is not moving, the defined group of messages being arranged in a defined order, and at least one action upon application of the rule for blocking the subsequent computer attack on the vehicle.