A method and apparatus for verifying the integrity of devices on a target
network. The apparatus has security subsystems and a master security
system hierarchically connected to the security subsystems via a secure
link. The target network includes various intrusion detection devices,
which may be part of the security subsystem. Each intrusion detection
device generates a plurality of event messages when an attack on the
network is detected. The security subsystem collects these event
messages, correlates, and analyzes them, and performs network scanning
processes. If certain events warrant additional scrutiny, they are
uploaded to the master security system for review.