at a receiving server machine in a security expert system, receiving information from said distributed computer system over a network, wherein said information comprises said event and wherein said event is detected by a device in said distributed computer system;

storing said event in a database in said security expert system;

at an expert system server machine in said security expert system:

retrieving said event from said database;

determining an attack validation value associated with said event;

determining a target exposure value associated with a host targeted by said event;

determining an attacker rating value associated with an attacker originating said event; and

determining a threat rating for said event utilizing said attack validation value, said target exposure value, and said attacker rating value; and

displaying said threat rating on a user interface for said security expert system.