7. The method of claim 4 , wherein said labeling step includes: enabling said system administrator to re-label select ones of said event window examples; and providing the re-labeled event window example to a theory refinement algorithm designed to determine which policy should be modified to correct classification of events according to the re-labeling of the select event window example.
8. The method of claim 7 , further comprising: generating an updated policy document; outputting said modified policy document to a system administrator for inspection, wherein said system administrator is able to modify said policy document and produce a new classifier; and implementing monitoring and security operations utilizing said refined policy document with the modifications of said system administrator.