Security of each organization is very important. Typically there is difference between security policy and status quo. While the security policy is stored in a library and the reality takes place mainly in the cyberspace. We need tools able to correlate events in the cyberspace with the security policy and visualize these events properly. These tools have to be oriented on security managers and support human decision process.