28. The system of claim 26 , further comprising: means for enabling system administrator validation of modification provided by said theory refinement process, whereby modification of a data extractor and a rule base of said classifier is completed.
26. The system of claim 23 , wherein said means for labeling includes: means for enabling said system administrator to re-label select ones of said event window examples; and means for providing the re-labeled event window example to a theory refinement algorithm designed to determine which policy should be modified to correct classification of events according to the re-labeling of the select event window example.