Apparatus and methods facilitate analysis of events associated with a plurality of computer systems. Event occurrence items are compared with event rules of event rule sets associated with each computer system to determine whether the items are potentially significant as determined by matching with the event rule sets. A scorer associated with each computer system assigns a score to each event occurrence item to provide a relative indication of the potential significance of the event occurrence item. An interface is used to query the scored event occurrence items from each of the plurality of computer systems.