Security Event Processing with Simple Event Correlator

This paper focuses on Simple Event Correlator – a lightweight event correlator written by one of the authors which is based on different design principles than commercial solutions. We will present an overview of SEC and discuss some real-life event correlation scenarios which highlight its capabilities. 2. If N events “Link Short Outage ” have been seen for a link within T2 seconds (e.g., N=3 and T2=3600), send an alarm to human operator about the degrading quality of this link. This sample scheme illustrates three important aspects of event correlation. First, one of the main purposes of event correlation is to reduce large volumes of input events to a smaller set of more meaningful output events in real time. Second, some results from event correlation might not be re-ported as output, but rather treated as intermediate knowl-edge, which is used for further knowledge deriving inside th