Abstract: Disclosed are apparatus and methods that facilitate analysis of events associated with network and computer systems. The methodology includes determining at least one lookup key in a host device for an event occurring in the host device and determining whether the at least one lookup key is used in a memory to determine if at least one key-value pair exists for the event. The methodology also includes appending the at least one key-value pair to the event, and storing the at least one key-value pair in the memory based on the at least one lookup key including replacing existing keys found for the at least one lookup key.

Abstract: Apparatus and methods facilitate analysis of events associated with network and computer systems. Event data, such as security threats, are comparison matched with event rules of event rule sets associated with each network or computer system to determine whether the items are potentially significant. Additionally, the system-event data may be scored where the score is used for prioritizing system-event data as to their significance. Associated with the comparison matching are various analytics that further analyze event data for measuring and analyzing the system-event data according to various algorithms.

Abstract: Apparatus and methods facilitate analysis of events associated with network and computer systems. Event data, such as security threats, are comparison matched with event rules of event rule sets associated with each network or computer system to determine whether the items are potentially significant. Additionally, the system-event data may be scored where the score is used for prioritizing system-event data as to their significance. Associated with the comparison matching are various analytics that further analyze event data for measuring and analyzing the system-event data according to various algorithms.