correlation of information received from Notification Processor and Network Manager;

grouping received information into current cases with assigned identifiers, that are unique in the system;

running actions (specified programs) for processed cases taking into consideration correlation of events included in their case, results of finished actions and time of its last occurrence;

processing events received from processes that aren't David system modules; it allows to respond to events not originated from SNMP agent;

getting information about current processed cases, failures and their service;

learning to recognize potentially dangerous events for monitored networks;

notifing an operator about received massages, pending cases, and recording user's identyfier and his/her reaction time.