Patent ID: 8560679

Claim:
A method, comprising: a first device, including a first hardware processor, receiving events, wherein one or more of the events originated in an event log that was generated by a computer network device; the first device normalizing the events to a common event schema; the first device transmitting the normalized events to a second device including a second hardware processor; the second device receiving the normalized events and correlating the normalized events according to a first rule; the first device storing the normalized events to a computer-readable storage device; the first device retrieving one or more of the normalized events from the computer-readable storage device; the first device transmitting the retrieved normalized events to the second device; and the second device receiving the retrieved normalized events and correlating the retrieved normalized events according to a second rule, wherein the second rule differs from the first rule, wherein the second rule is applied to live events reported by one or more computer network devices.