Patent ID: 7644365

Claim:
A computer-implemented method of analyzing security events, comprising: receiving and processing security events from one or more security devices in a network, including grouping the security events into network sessions, each session having an identified source and destination; causing display of a first graph on a display of a computer system, the first graph representing devices in the network, the devices including the one or more security devices and non-security devices, the displayed first graph including one or more individual device symbols and one or more group device symbols, each individual device symbol representing one of the one or more a security devices and each group device symbol representing a group of non-security devices of the network; causing display of a first security incident volume indicator on the display that indicates a number of network sessions whose source or destination is at any member of a group of non-security devices corresponding to a particular group device symbol displayed on the display; wherein causing display of the first security incident volume indicator includes causing the display to visually highlight the particular group device symbol in a manner that indicates the number network sessions whose source or destination is at any member of the group of non-security devices corresponding to the particular group device symbol.