Patent ID: 7673335

Claim:
A method for analyzing network security events, the method comprising: filtering a series of events into one or more sets of events based on one or more filtering criteria; associating each of the one or more sets of events with one or more active rules that are selected from a plurality of rules, each of the plurality of rules defining one or more actions to be performed when one or more events cause the rule to be triggered; evaluating each of the filtered events in at least one of the sets of events in accordance with the one or more active rules associated with the at least one set of events, wherein a result of the evaluation includes one or more work items, and wherein each of the work items includes at least one of the filtered events in the at least one set of events and at least one of the one or more active rules associated with the at least one set of events; dynamically allocating the one or more work items to one or more respective threads in a thread pool; and processing each of the allocated work items in accordance with the at least one active rule in the respective work items to determine whether to initiate the one or more actions defined in the at least one active rule.