Patent ID: 7685627

Claim:
A system for identifying events relating to a network incident, comprising: a policy store that provides network policies that include an Internet Protocol Security (IPSec) policy and a firewall policy, each policy comprising rules, each rule including a condition and an action, the network policies being stored using a common schema, the actions of the rules including an action to generate a policy enforcement event notification; a memory storing computer-executable instructions of a filter generator for generating filters from the network policies, the filters with filter conditions for triggering when a network policy should be applied to a network event; a policy engine that receives an indication that a filter was triggered for a network event, identifies applicable rules whose conditions are satisfied by the network event, and performs the actions of the applicable rules including generating a policy enforcement event notification; a network layer including: a firewall component that applies the filters generated by the filter generator to a firewall event, invokes the policy engine to enforce the firewall policy for the firewall event, and generates firewall event notifications for policy enforcement events; an IPSec component that enforces the IPSec policies provided by the policy store and generates IPSec event notifications for policy enforcement events; a notification queue for storing policy enforcement event notifications, firewall event notifications, and IPSec event notifications; a monitoring tool that monitors event notifications generated by the firewall component, the IPSec component, and the policy engine and when the network incident occurs, identifies from the notification queue, firewall events, IPSec events, and policy enforcement events related to the network incident; and a processor for executing the computer-executable instructions stored in the memory.