5. The method of claim 1 , comprising: storing the user data model including an individual unique user identifier (ID) and an account for the user for each security event; storing history in the user data model indicating a time period the user account is associated with the unique user ID; and associating the user with a security event of the security events based on the history.
1. A method of determining a security threat comprising: storing security events associated with network devices; storing an actor category model including a plurality of levels arranged in a hierarchy, wherein each level is associated with a subcategory for a category of the actor category model, wherein the actor category model comprises an attribute for users, and the actor category model comprises parent-child relationships between the plurality of levels, and child levels inherit rules from their parent levels; correlating security events with the actor category model, wherein the correlating of the security events with the actor category model includes identifying a user for each security event; determining the actor category model is applicable to the user for each security event and any of the security events associated with the user by matching the attribute for users in the actor category model with a user attribute of the user in a user data model; and identifying a level in the actor category model associated with the user for each security event; and determining, by at least one processor, whether the security threat exists based on the correlating, wherein the determining of whether the security threat exists based on the correlating includes determining a security rule for the identified level; and determining whether the security threat exists by applying the security rule.