Patent ID: 8806620

Claim:
A method comprising: establishing a security event manager on a mobile computing device; receiving security event data with the security event manager, the security event data being generated on the mobile computing device by at least one security event source of the mobile computing device; transmitting the security event data to an enterprise security event manager server in response to determining that the mobile computing device is communicatively coupled to the enterprise security event manager server; and responding to the security event on the mobile computing device with the security event manager if the mobile computing device is not communicatively coupled to the enterprise security event manager server, wherein responding to the security event comprises: (i) retrieving security policy data with the security event manager, the security policy data defining a set of security event rules for determining the occurrence of a security event; and (ii) determining an occurrence of a security event with the security event manager based on the security event data and the security policy data by: normalizing, on the mobile computing device, the security event data to generate normalized security event data, the normalized security event data having a predetermined data format; aggregating, on the mobile computing device, the normalized security event data to generate aggregated security event data, the aggregated security event data summarizing the normalized security event data; and correlating, on the mobile computing device, the aggregated security event data to determine an occurrence of a security event based on the security policy data and on context data associated with the mobile computing device.