An integrated security event management system (ISEMS) is disclosed and is based on service-oriented architecture (SOA) and includes one or more computers connected to one or more service-providing devices. At least one of the computers comprises one or more modules that are adapted to perform the following tasks: tasks to dynamically discover the service-providing devices and their services within a transit security domain in about real-time; tasks to acquire asynchronous state information notifications in about real-time from the discovered services; tasks to determine one or more Boolean outcomes from the asynchronous state information in about real-time via a configurable rules engine; and tasks to evaluate the one or more Boolean outcomes in about real-time via a configurable policy engine to determine state changes of one or more security policies.