Patent ID: 7089428

Claim:
A method for managing security information comprising the steps of: receiving raw computer events with a fusion engine from one or more data sources, each data source comprising an intrusion detector that assigns a priority status to each raw computer event, each raw computer event comprising one of suspicious computer activity and a computer attack; classifying the raw computer events with the fusion engine by assigning each raw computer event an event type parameter; storing the raw computer events; comparing each raw computer event and its type with computer environment information stored in a knowledge-based database; assigning context parameters to each raw computer event based on the comparison of a respective computer event and its type with the computer environment information; determining if a priority status of each raw computer event should be adjusted based on its assigned context parameters; adjusting a priority status or leaving a priority status of a raw computer event in tact based on the determination step; identifying one or more relationships between two or more raw computer events with the fusion engine to determine if the two or more raw computer events are part of a larger computer attack; in response to identifying one or more relationships between two or more raw computer events, generating a mature correlation event message; and displaying one or more mature correlation event messages on one or more consoles that describe relationships between raw computer events.