Patent ID: 8209759

Claim:
A computer-implemented method of managing security incidents in a network, the method comprising: receiving from at least one monitored security device at least one raw event related to a network attack on a target, the event received by one of a plurality of pluggable device support modules each configured to monitor packet flows on a reporting protocol of a monitored security device; normalizing the raw events, by the pluggable device support module, into a normalized event structure based on the monitored security device that generated the raw event, including assigning a mapped value for each of a severity and credibility based on the monitored security device that generated the raw event; adjusting each of the severity and credibility according to a set of rules, wherein the adjusted severity is a weighted sum based on the threat the attack poses to a target device, and wherein the adjusted credibility is a weighted sum based on vulnerabilities of the target and capability of the attacker to harm the target; collecting network flows related to the network attack on the target that are related to the received at least one raw event; identifying an offense based on the assigned and adjusted severity, relevance, and credibility of the normalized event and on the collected network flows; forwarding the identified offense for remediation.