A method of correlating events in a stream of data packets in which each data packet includes an event type identifier and an attribute associated with a type of event. A plurality of data packets of the stream of data packets is received and correlation set of selectors is applied to the received data packets. Each selector of the correlation set of selectors is responsive to data packets of a predetermined type of event to extract the attribute from the data packets. The method further includes assessing two or more data packets of the received data packets as correlating events if attributes extracted from the two or more data packets match. Additionally, the method includes accessing a correlation session in a data store for each correlating events match, the correlation session holding data items of tasks that process said correlating events.