1. In a network security system, a method for aggregating security events, the method comprising: receiving a security event from a network device; selecting one of a plurality of aggregation profiles, wherein the selected aggregation profile defines a maximum time range; identifying an aggregate event corresponding to the selected aggregation profile, wherein the aggregate event includes a count field whose value indicates how many security events are represented by the aggregate event; incrementing the count field value to represent the received security event; and transmitting the aggregate event when the time range of the security events represented by the aggregate event exceeds the maximum time range.