A system and method for the transformation of event correlation rules, such as those written in the Effective Policy through Intelligent Correlation (EPIC) Rule Language, into programming constructs that implement the functionality described by the rule. A match network module performs matching of rules by applying a forward chaining algorithm to an evaluation graph by matching network events that have been encapsulated into one or more tickets in the match network module. For every successful matching rule upon one or more network events reflected in tickets, the match network module creates at least one suggested responsive action. Since one input may satisfy multiple rules, a list of suggested responsive actions is created and sent to a conflict resolution module.