1. A system for matching a system event to a rule, the system comprising: a computer-readable data structure comprising a plurality of system event rules organized as a graph having a plurality of nodes, at least one node corresponding to a field in a rule and having a weight value; a processor configured to analyze the computer-readable data structure to determine whether an event comprising at least one field matches a description set of at least one rule from the plurality of system event rules by: for a node in the graph, comparing the field corresponding to the node to each field in the event; in the event of a match between the compared fields, adding the field to a list of matches; and sorting the list of matching fields according to the weight associated with each matching field.