1. A method comprising the steps of: receiving first information regarding an event associated with an operation of a computer system, said first information comprising one or more security related aspects of the event; storing first information in a memory; using a processor to compare at least one of the security related aspects to a collection of rules, the collection of rules comprising a plurality of rules related to security; based upon the comparison, identifying one or more rules from the collection of rules, where the comparison preliminarily reveals that the identified one or more rules may be violated by the event; determining by the processor, that a preliminarily violated rule has one or more preconditions to a final determination regarding a rule violation; if preconditions exist for a preliminarily violated rule, automatically analyzing the preconditions based on the first information; and storing a result of the analysis in a memory.