Management of raised security events at a data processing system

A non-transitory machine-readable medium storing program code, which when executed by one or more processors of a data processing system, cause the data processing system to:

• establish a software entity at the data processing system configured to act as a local monitoring entity for the data processing system;
• monitor the data processing system for insider risk scenarios based on a plurality of security policies using the local monitoring entity;
• raise an event, by the local monitoring entity, based on the monitoring of the data processing system in dependence on one or more criteria specified by a security policy of the plurality of security policies, wherein raising of the event is indicative of a violation of the security policy, wherein each of the plurality of security policies has a reporting priority, and wherein events raised by the local monitoring entity have a reporting priority;
• assign, by the local monitoring entity, a reporting priority to the event in dependence on the reporting priority associated with the security policy;
• based on the event having been raised, assign, by the local monitoring entity, a heightened reporting priority to one or more other events, the one or more other events being raised, by the local monitoring entity, in dependence on one or more other criteria of one or more other security policies of the plurality of security policies, wherein raising of the one or more other events are indicative of one or more violations of the one or more other security policies, and wherein the heightened reporting priority represents recognition, based on context provided by the event, of an increased importance of the one or more other events as compared to an importance represented by the reporting priority of respective security policies of the one or more other security policies;
• and
• report to a remote monitoring entity occurrence of events in dependence on their respective reporting priorities.

A method for implementation by one or more processors of a data processing system, the method comprising:

• establishing a software entity at the data processing system configured to act as a local monitoring entity for the data processing system;
• monitoring the data processing system for insider risk scenarios based on a plurality of security policies using the local monitoring entity;
• raising an event, by the local monitoring entity, based on the monitoring of the data processing system in dependence on one or more criteria specified by a security policy of the plurality of security policies, wherein raising of the event is indicative of a violation of the security policy, wherein each of the plurality of security policies has a reporting priority, and wherein events raised by the local monitoring entity have a reporting priority;
• assign, by the local monitoring entity, the reporting priority of the security policy to the reporting priority of the event;
• and
• in dependence on the event having been raised, assigning, by the local monitoring entity, a heightened reporting priority to one or more other events, the one or more other events being raised, by the local monitoring entity, in dependence on one or more other criteria one or more other security policies of the plurality of security policies, wherein raising of the one or more other events are indicative of one or more violations of the one or more other security policies, and wherein the heightened reporting priority represents recognition, based on context provided by the event, of an increased importance of the one or more other events as compared to an importance represented by the reporting priority of respective security policies of the one or more other security policies.