11. The apparatus of claim 10 , wherein in identifying the actions taken by the adversary in the computer system, the threat manager receives event data associated with an attack on the computer system; identifies commands in the event data; and identifies the actions from the commands using a set of abstraction rules.
12. The apparatus of claim 11 , wherein the threat manager anonymizes the event data to form anonymized event data, wherein the anonymized event data is used in analyzing the attack.