Patent ID: 7484097

Claim:
A method comprising: an operations center establishing authentication information associated with a first computer network security device, wherein said first computer network security device is located within a first computer network and is configured to generate security log data for said first computer network; said operations center receiving said security log data in data transmission from said first computer network security device, wherein said operations center is configured to monitor security of a plurality of computer networks, wherein said receiving said security log data comprises receiving a signature generated by said first computer network security device; said operations center authenticating said data transmission using said authentication information, wherein said authenticating comprises determining whether a timestamp associated with said received signature has expired; and said operations center analyzing said security log data to monitor security of said first computer network, wherein said analyzing comprises: automatically performing one or more queries on the security log data to identify a plurality of sub-events indicative of malicious activity in said first computer network; storing data representing the plurality of sub-events; and automatically correlating two or more of the sub-events in order to identify one or more patterns indicative of malicious activity in said first computer network.