An apparatus, method and computer readable medium, the method comprising: obtaining raw maritime data from a plurality of sources, the raw maritime data indicative of a geolocation of vessels at different times and comprises duplicative data obtained from separate sources; analyzing the raw maritime data to produce for each vessel a vessel story comprising a set of activities and corresponding timestamps, wherein the set of activities associated with each vessel is smaller by at least one order of magnitude than the raw maritime data associated with the each vessel; identifying a pattern in the vessel story associated with a vessel, wherein the pattern conforms with a risk event; and validating the risk event using the raw maritime data or vessel stories, whereby identifying the risk event using reduced resources than required to identify the risk event in the raw maritime data, and without increasing false positive metrics.