1. A method for automatic interpretation of system data utilized to create a policy document, said method comprising: filtering through each unknown event in a database of unknown events; selectively determining which unknown events among all of the unknown events in a database should be considered for inclusion in said policy document; and updating the policy document with event examples associated with the unknown events.