1. A computer-implemented method, comprising: receiving a selection of at least one security event attribute; displaying a subset of a first set of security events based on the at least one selected security event attribute; and storing information associated with the at least one selected security event attribute; wherein the information is capable of being used to subsequently and automatically summarize a subset of a second set of security events; wherein the subset of the second set of security events is summarized to reduce a number of security events that are displayed.