1. A method of producing at least one alert indication based on a number of events derived from an enterprise comprising: providing a plurality of enterprise device outputs, at least a portion of the outputs having different formats, each output containing an event relating to an enterprise device; translating each output into a common format event, adding knowledge to the common format event using knowledge base table files to generate a knowledge-containing common format event; and applying one or more rules from a set of rules to the knowledge-containing common format event to generate the alert indication.