Method for Threat Control in a Computer Network Security System

A method of threat control in a computer network security system, the method comprising:

• monitoring events collected from a plurality of network nodes;
• detecting a first suspicious event among the monitored events by a detection mechanism;
• monitoring the behaviour of the first suspicious event and any related events;
• in case the monitored first suspicious event and/or a related event is detected to perform an activity triggering an incident of compromise (IOC), generating a new IOC;
• monitoring new events when the activity ends;
• comparing the behaviour of the new events with the behaviour of the generated IOC;
• in case a matching behaviour is found, merging the new event with the first suspicious event and/or related events related to the generated IOC;
• and
• generating a security related decision on the basis of the IOC.