1. A method for characterizing events on a network comprising: processing a plurality of network events with a security event detector to identify a set of network events having a common source address and to generate a network security event for the set of network events, wherein said processing a plurality of network events with a security event detector to identify a set of network events having a common source address and to generate a network security event for the set of network events further comprises: generating an interest level for each set of network events having a common source address thereby generating a plurality of interest levels; and processing a first occurrence of a network event having the source address in the plurality of network events with a geo-location detector to generate a location identifier for the network event having the source address wherein a plurality of location identifiers are generated with each location identifier in said plurality being associated with a different source address.