Patent ID: 8887279

Claim:
A method for centrally managing information about security events detected by a group of protected web-connected resources, the method comprising: receiving a plurality of security event reports from one or more deployment components by a first computer, wherein each of the deployment components is coupled to a native service local to one of a plurality of web-connected resources of a plurality of additional, separate computers; based on the received security event reports, determining by the first computer a threat level indicator across the plurality of web-connected resources using one or more analyses and metrics; transmitting the determined threat level indicator to each of the web-connected resources of a plurality of the additional, separate computers; receiving the threat level indicator by each of the web-connected resources of the plurality of additional, separate computers; and one or more of the native services of the plurality of additional, separate computers selecting and performing a security breach abatement action according to the received threat level indicator, wherein the selecting is performed by the native service according to a Security Policy local to each corresponding additional, separate computer; wherein the threat indicator excludes instructions for security breach abatement.