An observation paradigm that works with a collection of the abovementioned elements, to provide a way of observing information infrastructures and data movement in a chosen time frame. The user (human observer) is provided sophisticated controls and interaction mechanisms that will make it easier for them to detect computer network intrusion and critical security management events in real time as well as allow them to better analyze past events. Embodiments may include various combinations of a framework for "intelligent agents"; an event handling system and a high-performance multi-layer observation facility presenting the user with a semantically dense depiction of an information source under consideration, such as a computer network.