19. A computer program product for managing an attack on a computer system, the computer program product comprising: a computer readable storage media; first program code, stored on the computer readable storage media, for identifying actions taken by an adversary in the computer system; second program code, stored on the computer readable storage media, for identifying links connecting the actions over time using an ontology defining linking rules for linking the actions; third program code, stored on the computer readable storage media, for creating a graph of the actions with the links connecting the actions over time, wherein the graph shows a number of patterns of behavior for the adversary, and wherein the graph comprises a linkograph; and fourth program code, stored on the computer readable storage media, for identifying a protective action to take with respect to the computer system using the graph of the actions taken by the adversary; fifth program code, stored on the computer readable storage media, for identifying, by the computer, a number of linkographs that are possible from the actions taken by the adversary and the linking rules in the ontology; sixth program code, stored on the computer readable storage media, for identifying, by the computer, metrics for the number of linkographs that indicate a likelihood that the actions taken by the adversary is the attack, wherein the metrics are selected from at least one of a ratio of links in the linkograph to total possible links, a ratio of the commands in the event data that belong to an action in an abstraction class to a subset of the commands in the event data, a ratio of backlinks present in the linkograph for the actions in the linkograph to a number of possible back links in the linkograph, or Shannon entropy for each possible sub-linkograph in the linkograph; and wherein the program code for creating, by the computer, the linkograph of the actions with the links connecting the actions over time comprises program code for identifying, by the computer, the linkograph based on the metrics for the number of linkographs.
19. A computer program product for managing an attack on a computer system, the computer program product comprising: a computer readable storage media; first program code, stored on the computer readable storage media, for identifying actions taken by an adversary in the computer system; second program code, stored on the computer readable storage media, for identifying links connecting the actions over time using an ontology defining linking rules for linking the actions; third program code, stored on the computer readable storage media, for creating a graph of the actions with the links connecting the actions over time, wherein the graph shows a number of patterns of behavior for the adversary, and wherein the graph comprises a linkograph; and fourth program code, stored on the computer readable storage media, for identifying a protective action to take with respect to the computer system using the graph of the actions taken by the adversary; fifth program code, stored on the computer readable storage media, for identifying, by the computer, a number of linkographs that are possible from the actions taken by the adversary and the linking rules in the ontology; sixth program code, stored on the computer readable storage media, for identifying, by the computer, metrics for the number of linkographs that indicate a likelihood that the actions taken by the adversary is the attack, wherein the metrics are selected from at least one of a ratio of links in the linkograph to total possible links, a ratio of the commands in the event data that belong to an action in an abstraction class to a subset of the commands in the event data, a ratio of backlinks present in the linkograph for the actions in the linkograph to a number of possible back links in the linkograph, or Shannon entropy for each possible sub-linkograph in the linkograph; and wherein the program code for creating, by the computer, the linkograph of the actions with the links connecting the actions over time comprises program code for identifying, by the computer, the linkograph based on the metrics for the number of linkographs. 24. The computer program product of claim 19 , wherein program codes are run during a time selected from at least one of during the attack or after the attack.