1. A method, comprising: receiving information from one or more sources; identifying in the information a first event that involves unauthorized access to a computer system, and a second event that involves unauthorized physical access to a physical vicinity of the computer system; and correlating the first event and the second event so as to detect an intrusion into the computer system.