In one embodiment, the present invention provides for receiving security
events from a network device by a distributed software agent of a network
security system, determining a priority of each received security event,
and storing the security events in a plurality of prioritized event
buffers based on the determined priorities for a period of time
determined by a timer. Upon expiration of the timer, a batch of security
events for transport to a security event manager of the network security
system can be created by including security events in the batch in order
of priority until the batch is full.