Abstract: A method and system for modeling cyber-security events are provided. The method includes receiving a plurality of cyber-security events, wherein each of the plurality of the cyber-security events defines at least one entity; for each of the plurality of received cyber-security events, processing a received cyber-security event to identify at least one key-value; mapping the at least one identified key-value to at least one data field; modeling the received cyber-security event to a security model, wherein the security model defines a specific activity related to the at least one entity, wherein the modeling is based on at least one modeling rule and the at least one identified key-value; and generating a graph based on the security model.