Defining XML threat policy Real-time security monitoring