Computer security threat correlation

A computer implemented method, comprising:

• receiving, at a computing device having a processor, a data stream providing security threat information transmitted over a computing network by a scalable multi-streaming data service, wherein the security threat information includes a recognized computer security threat detected by a first network component that sent the recognized computer security threat to the scalable multi-streaming data service,
• wherein the scalable multi-streaming data service is a managed streaming data service that is scaled to receive input data streams of security threat information from network components using a push access protocol and to send the security threat information in output data streams to multiple subscribing network components in parallel using the push access protocol;
• correlating, at the computing device using the processor, the security threat information with additional security threat information, forming correlated security threat information, wherein the additional security threat information is received via the scalable multi-streaming data service, and the additional security threat information is detected by a second network component that is interconnected to the first network component by way of the scalable multi-streaming data service, and correlation of the security threat information with the additional security threat information comprises identifying attributes of the security threat information and the additional security threat information that show a relationship between the security threat information and the additional security threat information;
• identifying, at the computing device using the processor, a computer security threat associated with the correlated security threat information;
• and
• sending, from the computing device using the processor, the computer security threat to the scalable multi-streaming data service, which sends the data stream containing the computer security threat to the subscribing network components.

A system comprising:

• a processor;
• a data store for stored security threat information;
• a memory device including instructions that, when executed by the processor, cause the system to:
• receive a data stream transmitted over a computing network by a scalable multi-streaming data service, the data stream containing security threat information for a recognized computer security threat detected by network components, wherein the scalable multi-streaming data service is a managed streaming data service that is scaled to receive input data streams of security threat information from network components using a push access protocol and to send the security threat information in output data streams to multiple subscribing network components in parallel using the push access protocol;
• correlate the security threat information with additional security threat information forming correlated security threat information that includes stored security threat information that is retrieved from the data store and security threat information received via the scalable multi-streaming data service detected by other network components, wherein correlation of the security threat information with the additional security threat information comprises identifying attributes of the security threat information and the additional security threat information that show a relationship between the security threat information and the additional security threat information;
• identify a computer security threat associated with the correlated security threat information;
• and
• send the computer security threat to the scalable multi-streaming data service that sends the data stream containing the computer security threat to network components, wherein the network components receive the data stream containing the computer security threat and execute security policy instructions associated with the computer security threat to address the computer security threat.