Event monitoring and management

A method of event reporting by an agent comprising:

• receiving data;
• determining if said data indicates a first occurrence of an event of interest associated with a metric since a previous periodic reporting;
• reporting said first occurrence of an event if said determining determines said data indicates said first occurrence;
• and
• reporting a summary including said metric in a periodic report at a first point in time.

A method of event reporting by an agent comprising:

• receiving data;
• determining if said data corresponds to an event of interest associated with at least one security metric;
• and
• sending a report to a reporting destination, said report including said at least one security metric for a fixed time interval, wherein said report is sent from said agent communicating data at an application level to said reporting destination using a one-way communication connection.

A method of event reporting by an agent comprising:

• receiving data;
• determining if said data indicates a security event of interest;
• and
• reporting a summary including information on a plurality of occurrences of said security event of interest occurring within a fixed time interval, said summary being sent at a predetermined time interval.

A computer program product for event reporting by an agent comprising code that:

• receives data;
• determines if said data indicates a first occurrence of an event of interest associated with a metric since a previous periodic reporting;
• reports said first occurrence of an event if said code that determines that said data indicates said first occurrence;
• and
• reports a summary including said metric in a periodic report at a first point in time.

A computer program product for event reporting by an agent comprising code that:

• receives data;
• determines if said data corresponds to an event of interest associated with at least one security metric;
• and
• sends a report to a reporting destination, said report including said at least one security metric for a fixed time interval, wherein said report is sent from said agent communicating data at an application level to said reporting destination using a one-way communication connection.

A computer program product for event reporting by an agent comprising code that:

• receives data;
• determines if said data indicates a security event of interest;
• and
• reports a summary including information on a plurality of occurrences of said security event of interest occurring within a fixed time interval, said summary being sent at a predetermined time interval.

A method of event notification comprising:

• receiving a first report of a condition;
• sending a first notification message about said first report of said condition;
• sending a second notification message about said condition at a first notification interval;
• receiving subsequent reports at fixed time intervals;
• sending a subsequent notification message at a second notification interval if said condition is still ongoing during said second notification interval, wherein said second notification interval has a length which is a multiple of said first notification interval.

A method of event notification comprising:

• receiving a first report of a condition at a reporting destination;
• and
• sending a notification message from said reporting destination to a notification destination, said notification message including a summary of information about events occurring in a fixed time interval, said summary identifying at least one of:
• a source and a target associated with an attack occurring within said fixed time interval, and a percentage of events associated with said at least one of said source and said target.

A computer program product for event notification comprising code that:

• receives a first report of a condition;
• sends a first notification message about said first report of said condition;
• sends a second notification message about said condition at a first notification interval;
• receives subsequent reports at fixed time intervals;
• and
• sends a subsequent notification message at a second notification interval if said condition is still ongoing during said second notification interval, wherein said second notification interval has a length which is a multiple of said first notification interval.

A computer program product for event notification comprising code that:

• receives a first report of a condition at a reporting destination;
• and
• sends a notification message from said reporting destination to a notification destination, said notification message including a summary of information about events occurring in a fixed time interval, said summary identifying at least one of:
• a source and a target associated with an attack occurring within said fixed time interval, and a percentage of events associated with said at least one of said source and said target.