Patent Document ID: 8229903
Application ID: 10324514

Base Claim:
1. A method for automatic interpretation of system data utilized to create a policy document, said method comprising: tracking events occurring on a system represented by system data said events including known events represented within the policy document and unknown events; storing said unknown events in a database of unknown events, wherein only unknown events, separate from known events, are stored in the database of unknown events; filtering through each unknown event; analyzing said unknown events within said database; identifying trends within said database of unknown events based on a historical treatment of said unknown events; selectively determining which unknown events among all of the unknown events should be considered for inclusion in said policy document; and updating the policy document with event examples associated with the unknown events selected for inclusion.

---

Claim 3:
3. The method of claim 1 , wherein said database is a text file configured with a single event per line of text, said method further comprising: converting said text to a code form that is readable by a clustering algorithm, wherein the clustering algorithm groups into clusters examples of events that are similar to each other; and passing said code foam to said clustering algorithm.