1. A method for processing data from a computer network to determine an occurrence of and characterize a particular activity associated with the computer network, comprising the steps of: managing a collection of data corresponding to events associated with the computer network; establishing at least one model to correlate an occurrence of a predetermined set of events; forming at least one hypothesis, using the at least one model, that characterizes the particular activity associated with the computer network; and evaluating the at least one hypothesis using the at least one model, wherein the steps of forming and evaluating are performed interactively with the step of managing to iteratively update the collection of data.