12. A distributed agent for a network security system, the distributed agent comprising: a log interface coupled to a message log to read a message and a host identifier of the sender of the message from the message log into the distributed agent; a parser database stored on a non-transitory machine-readable medium containing a host-specific list of multiple parsers associated with the host identifier; an event builder module coupled to the log interface and the parser database to attempt to parse the message using a first parser from the host-specific list of multiple parsers, and responsive to unsuccessful parsing using the first parser, the event builder configured to parse the message using a second parser in the host-specific list; and a device detection module to attempt to parse the message using a parser in a comprehensive list of multiple parsers in case the attempted parsing using the parsers in the host-specific list is unsuccessful for all parsers, and responsive to successfully parsing the message with a parser in the comprehensive list, the device detection module configured to add the parser to the host-specific list.
18. The distributed agent of claim 12 , wherein the host-specific list of multiple parsers in the parser database is organized according to a hierarchy of more specific parsers to more general parsers.