1. A system comprising: at least one sensor operable to receive one or more detected events, each detected event associated with at least one data packet in an enterprise network; at least one memory module operable to store one or more rules and a plurality of tables; at least one processor operable to: receive a query associated with an attribute value of a detected event; identify a rule for determining the attribute value, the rule associated with a rule identifier; identify in a first table a rule update time associated with the rule; apply the rule to determine attribute values for a plurality of detected events stored in a second table, wherein: the plurality of detected events in the second table occurred after the rule update time such that the rule is applied only to the plurality of detected events occurring after the rule update time and not to any detected events occurring before the rule update time; the plurality of detected events are associated with event identifiers; and each of the plurality of detected events is associated with a plurality of attribute values, the attribute values of each detected event defining a respective point in n-dimensional space; send to a third table the determined attribute values and the event identifiers; identify in the third table one or more event identifiers associated with one or more attribute values that satisfy the query; display to a user a set of query results, wherein the set of query results include one or more event identifiers associated with detected events occurring after the rule update time and one or more event identifiers associated with a cached query result of at least one detected event occurring prior to the rule update time; correlate the target event and one or more similar detected events of the second table, the correlation based at least in part on a distance between the respective points defined by the respective attribute values of the target event and the one or more similar detected events of the second table, wherein the distance between the respective points defined by the respective attribute values of the target event and the one or more similar detected events of the second table are proximate to one another indicating that the target event is similar to the one or more detected events; and identify a source of the target event as being the same as the source of the one or more similar detected events based on the correlation.