1. A method for managing security information comprising the steps of: receiving raw events from one or more data sources; classifying the raw events; storing the raw events; assigning a ranking to each raw event; identifying relationships between two or more raw events; in response to identifying any relationships between two or more raw events, generating a mature correlation event message; and displaying one or more mature correlation event messages on a console that describe relationships between raw events.