System for automatically discovering, enriching and remediating entities interacting in a computer network

A system for managing a computer environment, the system comprising:

• a workstation system for executing one or more entity event collectors for collecting event data for the computer environment from a plurality of different data sources by connecting to each data source and retrieving the event data available from that data source;
• a server system for executing a database system, which generates entity relationship information indicating entities and the relationships between entities that are relevant to security of the computer environment based on the collected event data from the plurality of different data sources, wherein the server system manages the computer environment based on the entity relationship information by:
• configuring a rules engine with user-specified rules for detecting specified conditions of the entities, properties of entities, and the relationships between entities indicated by the entity relationship information and for performing specified actions in response to detecting the specified conditions;
• and by
• identifying which rules of the rules engine can potentially be triggered by detected changes in conditions indicated by the entity relationship information and selectively evaluating the changed conditions against the specified conditions only with respect to the rules that were identified as potentially being triggered by the detected changes in the conditions.