1. A method in a computer system for enforcing a security policy, the method comprising: providing detection criteria available for the security policy; providing rules of the security policy, a rule specifying a detection criterion for a condition and an action; and when a security event occurs, evaluating the conditions of the rule, the evaluating including evaluating the provided detection criterion specified by the rule; and when the evaluation of the condition indicates to perform the action, performing the action of the rule.