Patent ID: 7549158

Claim:
A method in a computer system for customizing a security policy that is an implementation of a desired security policy for the computer system, the computer system having a processor and a memory, the method comprising: providing in the memory a security policy that includes scope, condition, and action information, the scope specifying criteria including values of attributes of a security event that need to satisfied for the security event to be within the scope of the security policy, the condition specifying a computer-executable procedure to be performed by the computer system based on values of attribute of the security event to determine whether a security event satisfies the condition of the security policy, and the action specifying an action to take when a within-scope security event satisfies the condition of the security policy; providing by the processor a user interface through which a user can modify the scope of the security policy but cannot modify the computer-executable procedure of the condition of the security policy; and when a security event occurs, determining by the processor whether the security event is within the modified scope of the security policy; and when it is determined that the security event is within the modified scope of the security policy, performing by the processor the procedure of the condition of the security policy to determine whether the security event satisfies the condition of the security policy and thus matches the security policy; and when it is determined that the security event matches the security policy, taking by the processor the action of the security policy.