Patent Document ID: 7594270
Application ID: 11321620
Patent Flag: 1

Claim One:
1. A method of analyzing an event detected in a distributed computer system, comprising: at a receiving server machine in a security expert system, receiving information from said distributed computer system over a network, wherein said information comprises said event and wherein said event is detected by a device in said distributed computer system; storing said event in a database in said security expert system; at an expert system server machine in said security expert system: retrieving said event from said database; determining an attack validation value associated with said event; determining a target exposure value associated with a host targeted by said event; determining an attacker rating value associated with an attacker originating said event; and determining a threat rating for said event utilizing said attack validation value, said target exposure value, and said attacker rating value; and displaying said threat rating on a user interface for said security expert system.