16. The computer system of claim 13 , wherein a respective record in the log data indicates a client event or a server event.
13. A computer system, comprising: a processor; and a storage device storing instructions which when executed by the processor cause the processor to perform operations comprising: receiving a set of rules translated from a security policy, wherein a respective rule from the set of rules is translated to be represented as a Semantic Web Rule Language (SWRL) statement; converting the security log data into Web Ontology Language (OWL)-based format by converting original relational database(RDB)-formatted log data into a Resource Description Framework (RDF) format; and applying the translated set of rules to the OWL-format log data; and identifying one or more records of the log data which indicate potential violation of the security policy based on results of applying the translated set of rules.