Patent ID: 8015604

Claim:
A network security system comprising: a plurality of subsystems, each subsystem comprising: a plurality of distributed software agents, each agent configured: to collect a security event from a monitor device; and to transmit the security event; a local manager module coupled to the plurality of distributed software agents, configured: to receive, from each agent, the security event; to generate one or more correlated events by correlating the received security events, wherein a correlated event comprises a conclusion drawn from the received security events; and to transmit the one or more correlated events; and a local manager agent coupled to the local manager module, configured: to receive, from the local manager module, the one or more correlated events; to process the one or more correlated events; and to transmit the processed correlated events; and a global manager module coupled to the plurality of subsystems, each subsystem comprising a local network security system, the global manager module configured: to receive, from each subsystem, the processed correlated events; and to correlate the received processed correlated events.