A method for detecting computer attacks comprising: gathering , using a hardware processor, information on an object in a computer in a network ; saving a security notification with the object in an object database in the network ; searching for the object in a threat database in the network ; adding one or more tags to the object when the object is found in the threat database and adding a correspondence between a record in the object database and the threat database ; wherein the method is characterized by the steps of: searching for suspicious activity based on the one or more tags in a suspicious activity database ; when a sign of suspicious activity is found in the suspicious activity database , adding a second tag to the security notification , the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity; and determining that a computer attack has occurred when the one or more tag and the second tag correspond to one or more signatures in a database of computer attacks , wherein a signature of the one or more signatures comprises: at least one record about the object , at least one record about the security notification , at least one tag of the object and at least one tag of the security notification. gathering , using a hardware processor, information on an object in a computer in a network ; saving a security notification with the object in an object database in the network ; searching for the object in a threat database in the network ; adding one or more tags to the object when the object is found in the threat database and adding a correspondence between a record in the object database and the threat database ; wherein the method is characterized by the steps of: searching for suspicious activity based on the one or more tags in a suspicious activity database ; when a sign of suspicious activity is found in the suspicious activity database , adding a second tag to the security notification , the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity; and determining that a computer attack has occurred when the one or more tag and the second tag correspond to one or more signatures in a database of computer attacks , wherein a signature of the one or more signatures comprises: at least one record about the object , at least one record about the security notification , at least one tag of the object and at least one tag of the security notification. searching for suspicious activity based on the one or more tags in a suspicious activity database ; when a sign of suspicious activity is found in the suspicious activity database , adding a second tag to the security notification , the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity; and determining that a computer attack has occurred when the one or more tag and the second tag correspond to one or more signatures in a database of computer attacks , wherein a signature of the one or more signatures comprises: at least one record about the object , at least one record about the security notification , at least one tag of the object and at least one tag of the security notification. <EOS>