1. A computer-implemented method, comprising: transferring, at a security event manager, data to a security data warehouse; comparing the data, at the security data warehouse, to information stored in a risk ontology, wherein the comparing is performed to determine whether the data should be transferred to a security information manager; receiving, at the security information manager, the data when the security data warehouse determines that the data should be transferred to the security information manager; comparing, at the security information manager, the data to stored rules and other stored information to determine a security context; transferring, at the security information manager, the security context to the security event manager, wherein the security context allows the security event manager to determine an event's risk level; receiving, at the security event manager, an event; and outputting, at the security event manager, the event's risk level.