Present disclosure provides a method for managing an event to generate an alert indicating a subject is likely to be unauthorized, the event comprising data identifying the subject, the method comprising: within a pre-determined period based on a timestamp at which the event is stored in a cache, detecting a recall event comprising the data identifying the subject, the recall event indicating the subject is not likely to be unauthorized; and removing the event from the cache in response to detecting the recall event comprising the data identifying the subject within the pre-determined period.