1. A method of generating a common event format representation of information from a plurality of messages, comprising: parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message; obtaining the property value from the previous message if the rule specifies to obtain the property value from the previous message; and populating the common event format representation for the current message with the obtained property value from the previous message.