And yes… if the situations are somewhat static and the rule or patterns are basically fixed or rarely change, this is not “complex event processing” by definition.

Complex event processing was designed (and defined) from inception for classes of problems where “complexity” is defined as you have defined it, for “complex” and dynamic detection scenarios.

When the “rules” are mostly static, easily defined, or rarely change (relative speaking), this is “simple event processing”.

CEP, as defined by the stream processing vendors, is a monumental failure, because the systems are nearly useless for every class of problem I work with on a daily basis.

If stream processing based approaches using pattern detection based on rules was useful, I would have CEP engines running “all over the place”.

For vendors to argue otherwise is folly at best, fraud at worst.

Complex events are a coupling of events related to state, rules, calculations and patterns. Complex event detection would certainly leverage objects, correlation, time windows, patterns, and complex rules. This seems like complex event detection. In the cyber world, I would probably leverage something like Snort to detect a complex event like a system intrusion. However, I would leverage a CEP engine to detect that this is a distributed attack (using concepts and windowing), and consult rules to determine the appropriate response (who is trying to attack me, a measure of my capability and capacity at any one location, and what I have already done in the past X minutes). Again, CEP engines were not the appropriate tool to detect the intrusion (e.g., complex event), but Snort wasn’t the appropriate tool to detect the complex response.

I agree that Tibco’s BE is superior to other CEP engines.

On the other hand, BE is still, at it’s core, a rules engine like Drools.

I don’t think rule-based approaches alone are useful for detection in most complex classes of problems.

And to Rainer, as ***** has plagiarized from most of my earlier presentations and posts without reference, I read from his recent presentations he (finally) understands that CEP is not based solely on rule-based approaches – however, he correctly said (finally!) that rule are good for “action”… detection of complex events is generally not a rule-based problem. I am really disappointed with *******’s style of arguing, denigrating then (finally) learning then plagiarizing others. Way too much “not invented here” and plagiarizing in EPTS…… On the other hand, it is encouraging to see many are slowing understanding what “complexity” is in operational detection problems.

@Brian – if you are using rules-engines for detection, you are not detecting complex events, you are detecting simple ones (simple event processing). This is not complex event processing, it is simple event processing.

But let’s discuss without polemic, not repeating the same allegations of the last years;-)

Regards,
Brian