1. A method, comprising: receiving, by a processor in a computer system, an event associated with an operation of the computer system, the event having one or more aspects; comparing at least one of the event's aspects to a database comprising rules; identifying one or more rules from the database based on the act of comparing the at least one aspect of the event to the database's rules information; making a preliminary determination that the event violates at least one of the identified one or more rules; determining that a preliminarily violated rule has one or more preconditions to a final determination regarding a rule violation; collecting information associated with the event; automatically analyzing the preconditions based on the one or more aspects of the event and the collected information; and storing the the result of the analysis in a memory.