Patent ID: 8613083

Claim:
A method, comprising: storing, in an event buffer of an agent device, a plurality of security events from a network device; determining a number of the security events stored in the event buffer; responsive to the number of security events in the event buffer reaching a predetermined number, selecting a set of security events from the plurality of security events based on a batching priority for each of the security events stored in the event buffer, wherein the batching priority for each security event is based on an event priority of the security event, an amount of time the security event has been stored in the event buffer, and a number of event batches that have been created since the security event was stored in the event buffer; and creating a batch of security events for transport to a security event manager by including the selected set of security events in the batch, wherein storing the plurality of security events comprises storing the plurality of security events in a prioritized event buffer based on an importance of the event priority of each of the security events.