A security server for responding to security-related incidents in a computer network including a plurality of client computers, the security server comprising: an event collection module communicatively coupled to the computer network, an event analysis module operatively coupled to the event collection module, and a solution module operatively coupled to the event analysis module; wherein the solution module is configured to formulate at least one recommendation for automatic implementation by the at least one client computer; characterized in that the event collection module is configured to obtain incident-related information that includes event-level information from at least one client computer of the plurality of client computers, the incident-related information being associated with at least a first incident which was detected by that at least one client computer and provided to the event collection module in response to that detection; the event analysis module is configured to reconstruct based on the incident-related information at least one chain of events causally related to the first incident, wherein the chain of events includes at least an end event that caused the first incident to be detected and a start event that chronologically precedes and is causally linked to the end event and that is indicative of a root cause of the first incident; and wherein the at least one recommendation being formulated by the solution module is based on the at least one chain of events, and includes a corrective/preventive action particularized for automatically responding to the first incident. an event collection module communicatively coupled to the computer network, an event analysis module operatively coupled to the event collection module, and a solution module operatively coupled to the event analysis module; wherein the solution module is configured to formulate at least one recommendation for automatic implementation by the at least one client computer; characterized in that the event collection module is configured to obtain incident-related information that includes event-level information from at least one client computer of the plurality of client computers, the incident-related information being associated with at least a first incident which was detected by that at least one client computer and provided to the event collection module in response to that detection; the event analysis module is configured to reconstruct based on the incident-related information at least one chain of events causally related to the first incident, wherein the chain of events includes at least an end event that caused the first incident to be detected and a start event that chronologically precedes and is causally linked to the end event and that is indicative of a root cause of the first incident; and wherein the at least one recommendation being formulated by the solution module is based on the at least one chain of events, and includes a corrective/preventive action particularized for automatically responding to the first incident. the event collection module is configured to obtain incident-related information that includes event-level information from at least one client computer of the plurality of client computers, the incident-related information being associated with at least a first incident which was detected by that at least one client computer and provided to the event collection module in response to that detection; the event analysis module is configured to reconstruct based on the incident-related information at least one chain of events causally related to the first incident, wherein the chain of events includes at least an end event that caused the first incident to be detected and a start event that chronologically precedes and is causally linked to the end event and that is indicative of a root cause of the first incident; and wherein the at least one recommendation being formulated by the solution module is based on the at least one chain of events, and includes a corrective/preventive action particularized for automatically responding to the first incident.