1. A method for automatic interpretation of system data utilized to create a policy document, said method comprising: tracking events occurring on a system represented by system data said events including known events represented within the policy document and unknown events; storing said unknown events in a database of unknown events, wherein only unknown events, separate from known events, are stored in the database of unknown events; filtering through each unknown event; analyzing said unknown events within said database; identifying trends within said database of unknown events based on a historical treatment of said unknown events; selectively determining which unknown events among all of the unknown events should be considered for inclusion in said policy document; and updating the policy document with event examples associated with the unknown events selected for inclusion.