Multi-host threat tracking

A system for responding to data security threats in an organization, the system comprising:

• a memory and one or more processors that act as:
• a threat aggregator service (“threat aggregator”) executing upon an analysis computer system that receives events sent from and observed by user devices within the organization, and creates and/or updates threats based on the events;
• and
• an endpoint telemetry system that identifies possible attacks upon the organization based on the threats, and determines whether the possible attacks are associated with known attacks and provides security policies that specify actions for responding to the threats;
• wherein the endpoint telemetry system determines whether the possible attacks are associated with known attacks and provides security policies that specify actions for responding to the threats by:
• matching each possible attack of the identified possible attacks to records of known extraneous threats and/or of false positive threats;
• and
• sending a description of the possible attacks matching the records of known extraneous threats and/or of false positive threats in conjunction with a discard action to the threat aggregator, and in response, the threat aggregator discarding locally stored threats having a description matching the sent description of the possible attacks and/or discarding any subsequent events received from user devices having a description matching the sent description of the possible attacks.