Multidimension clusters for data partitioning

A security information and event management system comprising:

• a partitioning module executed by at least one processor to determine a plurality of dimensions, partition event data across the plurality of dimensions simultaneously based on a sizing parameter for each dimension, and store a cluster including the partitioned event data;
• a data storage device to store a plurality of clusters and metadata for each cluster, wherein the metadata for each cluster includes attributes identifying the cluster from other stored clusters;
• a query manager to receive a query, identify a cluster from the metadata for the plurality of stored clusters that includes data relevant to the query, and execute the query on the identified cluster;
• and
• an event processing engine to correlate query results from the executed query in accordance with rules, instructions or requests to identify network security threats.

A non-volatile computer readable medium including machine readable instructions executable by at least one processor to:

• determine a plurality of dimensions;
• partition event data across the plurality of dimensions simultaneously based on a sizing parameter for each dimension;
• and
• store a cluster including the partitioned event data and metadata including attributes identifying the cluster from a plurality of stored clusters.