1. A method for monitoring security of a computer network, the computer network comprising network devices, the method comprising: receiving security events generated by the network devices, wherein a security event generated by a network device is in a format used by the network device; modifying the security events to normalize the security events to a common schema, wherein the common schema includes a category that represents an event name; selecting one or more of the normalized security events according to a filter; and cross-correlating the selected security events with a rule, wherein the cross-correlating is performed remotely from the normalizing.