Patent Document ID: 8141157
Application ID: 12632492
Patent Flag: 1

Claim One:
1. A method for identifying a computer attack, the method comprising the steps of: a computer receiving computer events from one or more data sources, each of the data sources comprising an intrusion detector that assigns a priority status to each of the computer events, each of the computer events comprising computer activity identified as a possible attack on one or more computers in a network and a priority status assigned by one of the intrusion detectors; the computer classifying each of the computer events by assigning event type parameters to the computer events respectively; the computer assigning context parameters to the computer events respectively and adjusting or leaving intact the priority status of the respective computer events based on a comparison of a respective computer event and event type parameter with information indicating conditions in the network; the computer identifying one or more relationships between two or more computer events by using rules associated with the event type parameters to determine if the two or more computer events are part of a coordinated computer attack; in response to identifying one or more relationships between the two or more computer events, the computer generating an event message indicating that a correlation event comprising the two or more computer events has occurred; and the computer displaying one or more event messages that describe relationships between computer events.