A method of processing raw events to typed events, each raw event including data items containing data values, the method includes: providing a library of event type objects, each event type object relating to a given event type and including attributes of given data types, the attributes in each event type object structured according to a given structure; for each raw event, determining an event type object in the library which meets: (i) each of the data items in the raw event maps to an attribute in the event type object, and (ii) a data value in each of the data items is of a data type detected to match the given data type of the mapped attribute; and generating a typed event from each raw event, the typed event including the data values of the raw event structured according to the structure of the determined event type object.