1. A computer-implemented method comprising: identifying, by a computer, a plurality of features in a data stream associated with a data source; assigning, by the computer, an initial confidence score to each respective feature of the plurality of features; determining, by the computer, a candidate score of one or more features of the plurality of features using the initial confidence score of each respective feature in the one or more features, based upon a number of occurrences of each respective feature identified in the one or more features; identifying, by the computer, an event candidate when the candidate score of the one or more features satisfies a predetermined threshold, wherein the event candidate is defined by the one or more features; automatically determining, by the computer, whether the one or more features identified in the data stream as the event candidate satisfy one or more event models in a categorization table, based upon the computer comparing the one or more features of the data stream against the one or more event models, wherein an event concept store comprises a non-transitory machine-readable memory storing the one or more event models; and responsive to the computer determining that the one or more features from the data stream fail to satisfy at least one event model in at least one categorization table stored in the event concept store: comparing, by the computer, the one or more features against one or more uncategorized event models in an uncategorized event table stored in the event concept store wherein the uncategorized event table store records associated with new unknown event models; storing, by the computer, the one or more features as a new uncategorized event model in the uncategorized event table, in response to determining the one or more features fail to satisfy at least one uncategorized event model; generating, by the computer, an increased confidence score of an uncategorized event model of the one or more uncategorized event models in the uncategorized event table when the one or more features satisfy the uncategorized event model of the one or more uncategorized event models in the uncategorized event table; calculating, by the computer, a probability score for the event candidate based on a likelihood that the one or more features represent a new event model; comparing, by the computer, the increased confidence score of the event candidate and the probability score of the event candidate with a pre-determined threshold score of the uncategorized event model of the one or more uncategorized event models in the uncategorized event table; and storing, by the computer, the uncategorized event model in the categorization table when the increased confidence score and the probability score is higher than or matches the pre-determined threshold score.
1. A computer-implemented method comprising: identifying, by a computer, a plurality of features in a data stream associated with a data source; assigning, by the computer, an initial confidence score to each respective feature of the plurality of features; determining, by the computer, a candidate score of one or more features of the plurality of features using the initial confidence score of each respective feature in the one or more features, based upon a number of occurrences of each respective feature identified in the one or more features; identifying, by the computer, an event candidate when the candidate score of the one or more features satisfies a predetermined threshold, wherein the event candidate is defined by the one or more features; automatically determining, by the computer, whether the one or more features identified in the data stream as the event candidate satisfy one or more event models in a categorization table, based upon the computer comparing the one or more features of the data stream against the one or more event models, wherein an event concept store comprises a non-transitory machine-readable memory storing the one or more event models; and responsive to the computer determining that the one or more features from the data stream fail to satisfy at least one event model in at least one categorization table stored in the event concept store: comparing, by the computer, the one or more features against one or more uncategorized event models in an uncategorized event table stored in the event concept store wherein the uncategorized event table store records associated with new unknown event models; storing, by the computer, the one or more features as a new uncategorized event model in the uncategorized event table, in response to determining the one or more features fail to satisfy at least one uncategorized event model; generating, by the computer, an increased confidence score of an uncategorized event model of the one or more uncategorized event models in the uncategorized event table when the one or more features satisfy the uncategorized event model of the one or more uncategorized event models in the uncategorized event table; calculating, by the computer, a probability score for the event candidate based on a likelihood that the one or more features represent a new event model; comparing, by the computer, the increased confidence score of the event candidate and the probability score of the event candidate with a pre-determined threshold score of the uncategorized event model of the one or more uncategorized event models in the uncategorized event table; and storing, by the computer, the uncategorized event model in the categorization table when the increased confidence score and the probability score is higher than or matches the pre-determined threshold score. 6. The method according to claim 1 , further comprising: determining, by the computer, whether the one or more features identified in the data stream satisfy an event model in the categorization table; and automatically identifying, by the computer, in one or more categorization tables an event model associated with the event candidate, in response to determining that the one or more features satisfy the event model of the one or more event categorization tables.