1. A method of correlating events in a stream of data packets each representing an event, each data packet carrying at least one attribute of its event, comprising: classifying events according to event types and incorporating an identifier of the type of its event into each data packet, providing at least one correlation set of selectors, each selector being responsive to data packets of a predetermined event type identifier and extracting one or more attributes therefrom, applying said correlation set of selectors to said stream of data packets, and assessing two or more data packets as correlating events if the attributes so extracted by the responding selectors match.