Patent ID: 8341105

Claim:
A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising: associating a plurality of events with one another based on at least one identifier that is common to each of the plurality of events, wherein the plurality of events includes a plurality of e-mail communications; applying at least one rule to the associated events, wherein the at least one rule includes a first threshold associated with a number of instances of a particular type of content associated with the associated events, and wherein exceeding the first threshold results in a designation that collectively the associated events are associated with unwanted activity, and wherein each of the associated events are scored such that an aggregation of individual scores for the associated events are compared to a second threshold provided in the at least one rule to determine whether the associated events are associated with the unwanted activity, wherein the at least one rule is conditionally applied to the associated events based on a temporal proximity between identifying a first event of the associated events and identifying a second event of the associated events; and reacting, based on the application of the at least one rule, by blocking a particular one of the events, alerting the user of the particular one of the events, quarantining the particular one of the events, and archiving the particular one of the events.