Method and system for analysis of security events in a managed computer network

A method for managing events, comprising:

• receiving, by an event retrieval and analysis computer, a multiplicity of event data that represents a respective multiplicity of events corresponding to a device;
• categorizing, by the event retrieval and analysis computer, the multiplicity of event data into one or more categories, each category representing a summary of a particular severity or type of potential attack on the device;
• determining, by the event retrieval and analysis computer, a total number of events in each of the categories and a stored profile of the events for each of the events corresponding to the device;
• calculating, by the event retrieval and analysis computer, a percentage increase of the total number of events for each of the categories based on the total number of events of each of the categories and the stored profile of events of the respective category;
• determining, by the event retrieval and analysis computer, a range of number of events within which the total number of events for each category fits from a plurality of ranges of the number of events stored in a database,
• wherein each range of number of events of each of the categories bound by a maximum and minimum event count value, and wherein each range of the number of events is associated with an alert percentage value;
• for each category, determining, by the event retrieval and analysis computer, the alert percentage value associated with the range of the number of events within which the total number of events for the respective category fits, the alert percentage value comprising a value above-which alerts are triggered;
• and
• for each category, determining, by the event retrieval and analysis computer, if the percentage increase of the number of events is greater than the alert percentage value of the respective category to generate an alert.

An event retrieval and analysis system, comprising:

• a computer network;
• one or more sensors communicably coupled to a device and configured to collect and transmit a multiplicity of event data for a respective multiplicity of events corresponding to the device;
• an aggregator communicably coupled to the one or more sensors via the computer network and configured to:
• receive the multiplicity of event data;
• add the multiplicity of event data to a queue for the device;
• determine that the queue is not full and a predetermined amount of time has passed since a prior categorization of events represented by respective event data on the queue;
• responsive to determining that the queue is not full and a predetermined amount of time has passed since a prior categorization of events, based on the event data for each of the multiplicity of events, categorizing, by the event retrieval and analysis computer, each of the multiplicity of events as at least one of
• a worm signature event category that represents worm attacks against the device,
• a sweeps signature event category that represents sweep attacks against a network leading to the device, and
• a hot decodes signature event category that represents high priority signatures tracked by a user;
• and
• a scheduler communicably coupled to the aggregator via the computer network and configured to compare a total number of the events in each of the categories to a respective reference number, and responsive to any of the categories where the respective total number of the events exceeds the respective reference number by a predetermined amount, generating and issuing a notice.