Abstract: Confidence-based event group management, workflow exploitation and anomaly detection, including: detecting an event in a computing system; adding the event to an event group; and calculating a group confidence level for the event group based on an event confidence level for the event and at least one of: one or more attributes of the event or one or more relationships between a source of the event and sources of events in the event group.

Abstract: A method and apparatus for a multi-state window is accomplished by presenting a multi-state window on a computer screen in various states. In a given state, or ghost state, the multi-state window is provided on screen in a translucent form. In the translucent form, a window overlapped by the multi-state window will be shown and remain in focus. When a user input is received in the overlapped portion, a multi-state window driver associated with the multi-state window will provide the input to the overlaid window, i.e., to its associated window driver. If the user decides to activate the multi-state window, the multi-state window driver transforms the multi-state window from the translucent state to an in-focus state. When in the in-focus state, the user inputs are processed by the multi-state window driver and not provided to the overlaid window.