1. A method, comprising: determining if a rule in a memory of an event-based analysis engine has been used by the event-based analysis engine within a predetermined period of time comprising analyzing a last used field of an entry of a rule index; and moving the rule to a storage device if the rule in the memory of the event-based analysis engine has not been used by the event-based analysis engine within the predetermined period of time.