Correlation and policy engine system and method of operation

A method, comprising:

• obtaining one or more event messages from a data source, wherein each event message is generated by one or more state changes within a network;
• filtering each event message based on one or more active event policies;
• enriching each event message, that is missing predetermined information, from an inventory;
• evaluating each event message to determine whether an action is to be performed based upon an active policy corresponding to an event message;
• and
• executing the action corresponding to the event message.

A device comprising:

• a non-transitory, tangible computer readable storage medium storing a computer program, wherein the computer program contains instructions that when executed, cause the device to perform operations comprising:
• obtain one or more event messages from a data source, wherein each event message is generated by one or more state changes within a network operatively connected to the device;
• filter each event message based on one or more active event policies;
• enrich each event message, that is missing predetermined information, from an inventory;
• evaluate each event message to determine whether an action is to be performed based upon an active policy corresponding to an event message;
• and
• execute the action corresponding to the event message.