One way to address computer data security is to prevent or mitigate intrusions, that is, unauthorized data accesses. To mitigate intrusions it is helpful, of course, to detect them. One tool for detecting intrusions is to monitor user activities concerning data that is to be protected. Traditionally, real-time monitoring software systems may capture user activities rather indiscriminately and send all the captured information as an audit report to one or more repositories. For example, all the captured information is sent to a centralized repository and all the captured information is also sent to a back-up repository.