There is a great number of sources for security information and statuses in an IT system. Various devices generate a large amount of logs which are difficult to track and analyse in real time so it often happens that some incidents are noticed too late or are not seen at all.