Abstract: A method and system for modeling cyber-security events are provided. The method includes receiving a plurality of cyber-security events, wherein each of the plurality of the cyber-security events defines at least one entity; for each of the plurality of received cyber-security events, processing a received cyber-security event to identify at least one key-value; mapping the at least one identified key-value to at least one data field; modeling the received cyber-security event to a security model, wherein the security model defines a specific activity related to the at least one entity, wherein the modeling is based on at least one modeling rule and the at least one identified key-value; and generating a graph based on the security model.

Abstract: A system and method for contextually analyzing potential cyber security threats. The method comprises receiving at least one event, wherein the at least one event is associated with at least one entity; parsing the at least one event; modeling, based on at least one modeling rule, the at least one parsed event to determine the at least one characteristic; and generating a graph based on the determined at least one characteristic, wherein the graph represents the relationships among the at least one entity.