Integrated security administrator

An Integrated Security Administrator (ISA) for managing an Informational Network (IN) includes a plurality of monitoring agents, wherein at least one of the plurality of monitoring agents is configured to obtain a plurality of events from a plurality of monitored elements, reduce the plurality of events to obtain a reduced plurality of events, select an event from the reduced plurality of events, characterize the event using stored knowledge, and respond to the event at a response level, and a core system configured to update data and instructions stored on the at least one of the plurality of monitoring agents.