1. A method for providing feedback on a proposed security rule, the method comprising the steps of: receiving, by a computer, entry of a proposed security rule during a security-rule creation session; during the proposed security-rule creation session, testing, by the computer, the proposed security-rule by applying the proposed security rule to historical logged event data; determining, by the computer, a number of matches returned by the proposed security rule that result from application of the proposed security-rule to the historical logged event data; determining, by the computer, a predicted performance of the proposed security rule as part of a network security system based, at least in part, on the number of matches; and sending, by the computer, a message during the creation session of the proposed security-rule, wherein the message includes a recommended change for a portion of the proposed security based, at least in part, on the predicted performance of the proposed security rule.