A computer-automated method of hierarchical event monitoring and analysis within an enterprise network comprising:</claim-text> deploying a plurality of network monitors in the enterprise network; detecting, by the network monitors, suspicious rk activity based on analysis of network traffic data selected from one or more of the following categories: {network packet data transfer commands, network packet data transfer errors, network packet data volume, network connection requests, network connection denials, error codes included in a network packet, network connection acknowledgements, and network packets indicative of well-known network-service protocols}; generating, by the monitors, reports of said suspicious activity; and automatically receiving and integrating the reports of suspicious activity, by one or more hierarchical monitors. view more

The method of claim 1, wherein integrating comprises correlating intrusion reports reflecting underlying commonalities.

An enterprise network monitoring system comprising:</claim-text> a plurality of network monitors deployed within an enterprise network, said plurality of network monitors detecting suspicious network activity based on analysis of network traffic data ted from one or more of the following categories: {network packet data transfer commands, network packet data transfer errors, network packet data volume, network connection requests, network connection denials, error codes included in a network packet, network connection acknowledgements, and network packets indicative of well-known network-service protocols}; said network monitors generating reports of said suspicious activity; and one or more hierarchical monitors in the enterprise network, the hierarchical monitors adapted to automatically receive and integrate the reports of suspicious activity. view more

The system of claim 13, wherein the integration comprises correlating intrusion reports reflecting underlying commonalities.

A computer-automated method of hierarchical event monitoring and analysis within an enterprise network comprising:</claim-text> deploying a plurality of network monitors in the enterprise network; detecting, by the network monitors, suspicious rk activity based on analysis of network traffic data selected from the following categories: {network packet data transfer commands, network packet data transfer errors, network packet data volume, network connection requests, network connection denials, error codes included in a network packet}; generating, by the monitors, reports of said suspicious activity; and automatically receiving and integrating the reports of suspicious activity, by one or more hierarchical monitors. view more

The method of claim 1, wherein integrating comprises correlating intrusion reports reflecting underlying commonalities.

An enterprise network monitoring system comprising:</claim-text> a plurality of network monitors deployed within an enterprise network, said plurality of network monitors detecting suspicious network activity based on analysis of network traffic data ted from the following categories: {network packet data transfer commands, network packet data transfer errors, network packet data volume, network connection requests, network connection denials, error codes included in a network packet}; said network monitors generating reports of said suspicious activity; and one or more hierarchical monitors in the enterprise network, the hierarchical monitors adapted to automatically receive and integrate the reports of suspicious activity. view more

The system of claim 12, wherein the integration comprises correlating intrusion reports reflecting underlying commonalities.