1. A computer-implemented method comprising: receiving an event over a computer network; identifying a correlation rule that corresponds to the event; retrieving external data based upon the identified correlation rule; determining whether to monitor the event based upon the external data; and monitoring the event in response to the determination.