Patent ID: 8224761

Claim:
A method for generating correlation rules for events, comprising: receiving event data for each of a plurality of events, the event data of a particular event comprising at least one attribute associated with that event; displaying the event data for each of the plurality of events to an operator, the event data for the plurality of events having been processed according to one or more rules of a ruleset stored in a memory, the event data being displayed in a unified interface for displaying event data processed by rules in the ruleset and for creation of new correlation rules; receiving a selection made using the unified user interface of at least a portion of the plurality of events for which event data is displayed to the operator in the unified user interface; generating at least one new rule that correlates the selected events, the at least one new rule generated based at least in part upon a pattern spread among the attributes associated with the selected events, the at least one new rule generated by at least one processor; storing the at least one new rule and the selection of at least a portion of the events in the memory such that the at least one new rule is added to the ruleset stored in the memory; and re-displaying, in the unified interface for displaying event data processed by rules in the ruleset and for creation of new correlation rules, the event data to the operator such that the event data is correlated in accordance with the at least one new rule.