BACKGROUND

A computer system may be subject to a security attack in which an external entity seeks to access information that is stored on the computer system or harm components of the computer system. To prevent or at least inhibit such security attacks, the computer system may have various mechanisms to limit access, such as firewalls, passwords, keys, and so forth. Moreover, the computer system may have mechanisms to recognize security threats and automatically take actions to mitigate the effects of the security attacks, such as anti-spyware, screening software, anti-virus software, and so forth. Larger organizations may have a security information and event management (SIEM) system to correlate system events to aid human security analysts in identifying security incidents, monitor security threats, identify suspicious activity for further investigation by human security analysts, monitor security threats and coordinate responses to security incidents.

