Patent ID: 7904965

Claim:
A method for coalescing user action objects, the method comprising: monitoring user actions in a storage area network (SAN) having an operator console including a non-transitive computer readable medium for executing processor based instructions; receiving, in a network server coupled via an interface to the operator console, a user action; invoking, responsive to the user action, a service performing the user action; gathering information about the user action; normalizing the gathered information by building a user action object indicative of the user action, the user action object defining a generic security transaction adaptable to a plurality of services, normalizing further including: deploying, in each of the services, an event normalizer for populating the generic security transaction; instantiating, by each of a plurality of dissimilar services, the generic security transaction; and generating the generic security transaction including the information about the user action; sending, via a preexisting logging conduit, the generic security transaction to a security event coalescer, the preexisting conduit responsive to the generic security transaction, wherein the preexisting conduit is applicable, without modification, to each of the deployed normalizers for transporting a plurality of the security sensitive actions; coalescing, at the security event coalescer, the sent user action object with at least one other sent user action object; sending and coalescing further including: sending, by each of the plurality of services, at least one generic security transaction to the security event coalescer, the coalescer responsive to each of the generic security transactions; and receiving, at the security event coalescer, each of the generic security transactions; and recording a plurality of coalesced user action objects.