25. The system of claim 23 , wherein the conversion module is further configured to convert the anomalous database query into the characteristic representation by creating a tuple that describes anomaly parameters for the anomalous database query.
25. The system of claim 23 , wherein the conversion module is further configured to convert the anomalous database query into the characteristic representation by creating a tuple that describes anomaly parameters for the anomalous database query. 27. The system of claim 25 , wherein the tuple is added as an attribute to the incident generated, the tuple including a count to indicate how many times the tuple of parameters was seen.