Platform as a service (PAAS) featuring software platforms for security surveillance that provide optimized threat intelligence information through the use of practical and accurate algorithms that filter out event types that are less relevant, less actionable and unnecessary to security threat detection processing by security information and event management (SIEM) software systems, and that identify the difference between normal and abnormal user behavior, specific to a particular organization