Patent ID: 8423894

Claim:
A method comprising: causing display of a table comprising rows of data arranged in columns; wherein data displayed in the table defines a set of network events that constitute a security incident; wherein data displayed in at least one row of the rows defines a subset of one or more network events of said set of network events; wherein data displayed in the at least one row specifies a plurality of network event constraints that define the subset; wherein the plurality of network event constraints comprises a source network address constraint, a destination network address constraint, and a network event type constraint; wherein the table is editable by a user to specify one or more network event constraints of said plurality of network event constraints; wherein data displayed in the at least one row specifies a current logical or temporal relationship between the subset and a set of one or more network events defined by data displayed in another row in the table; wherein the table is editable by a user to specify a new current logical or temporal relationship between the subset of one or more network events of said set of network events displayed in one row of the at least one row in the table and a set of one or more network events defined by data displayed in another row in the table; wherein the method is performed by one or more computing devices.