Intelligent IT operation system which can fully integrate 3 major network and security management technologies, and build up dynamic reasonable threshold by event log and flow historical records automatic learning technology, and then trigger an alert when abnormal usage is detected.