1. A system comprising: one or more processors; and a storage module communicatively coupled to the one or more processors, the storage module comprising logic that, upon execution by the one or more processors, performs operations comprising: processing an object in a first virtual machine; upon detection of a triggering event within the first virtual machine, providing information associated with the triggering event to a security virtual machine, the security virtual machine is different from the first virtual machine; and determining, within the security virtual machine, whether the object is malicious based upon an analysis of the information associated with the triggering event using one or more correlation rules.