Patent ID: 7571480

Claim:
A method in a data processing system for reporting security situations, comprising the steps of: logging events by storing event attributes in memory as an event set, wherein each event set includes a source computing device attribute, a target computing device attribute and an event category attribute; classifying, by a processor, events as groups by aggregating events with at least one attribute within the event set as an identical value, wherein each event is classified into a plurality of groups, wherein an event in a group has a predefined number of attributes with values identical to other events in the group, wherein the attributes having identical values of one group are different from the attributes having identical values of another group, and wherein the identical value of at least one attribute of one group differs from the identical value of a corresponding attribute of another group; calculating, by a processor, severity levels for the groups, wherein a severity level for a group is a function of a number of events comprising the group and values of common elements in the group; and reporting a group from the groups to a user as a situation, if a severity level of the group exceeds a threshold value.