1. A method for using a plurality of different security products in a computer network by classifying security rules of the security products into a security decision engine in a service, comprising: receiving at least one security rule from at least one attack database of each of at least two different ones of the security products; normalizing each of the received security rules; generating a vector for each of the least one normalized security rule, wherein each vector is generated based on a set of terms indicative of a cyber-solution; mapping each of the generated vectors to one of a plurality of security services, wherein each of the security services represents a cyber-solution category, wherein the mapping is performed using a classification model; and associating each of the security rules with the respective security service to which its corresponding vector was mapped, when an evaluation threshold is met.