1. A method, comprising: a first device receiving security events, wherein one or more of the security events originated in an event log that was generated by a computer network device; the first device normalizing the security events to a common event schema; the first device transmitting the normalized security events to a second device; the second device receiving the normalized security events and correlating the normalized security events according to a first rule defining a security incident; the first device transmitting the normalized security events to a computer-readable storage medium; the first device retrieving one or more of the normalized security events from the computer-readable storage medium; the first device transmitting the retrieved normalized security events to the second device, wherein the transmission of the retrieved normalized security events to the second device is performed faster than the initial transmission of the normalized security events to the second device; the second device receiving the retrieved normalized security events and correlating the retrieved normalized security events according to a second rule defining a security incident, wherein the second rule differs from the first rule; and the second device generating a meta-event when the retrieved normalized security events satisfy a condition associated with the second rule.