Techniques for detection and analysis of network assets under common management

A system comprising:

• a network analytic component, implemented at least partially by hardware, configured to:
• gather a plurality of data sets from a plurality of data sources;
• receive one or more criteria via a graphical interface, the one or more criteria used to filter the plurality of data sets into a plurality of data records;
• generate the graphical interface to display the plurality of data records;
• receive, via the graphical interface, a first selection of a first attribute of the plurality of data records, wherein the first attribute comprises a name server attribute;
• generate the graphical interface to display a first filtered plurality of data records based on the first selection of the first attribute filtering the plurality of data records;
• receive, via the graphical interface, a second selection of a second attribute of the first filtered plurality of data records;
• filter the first filtered plurality of data records based on the second attribute to generate a second filtered plurality of data records;
• identify, using the first attribute and the second attribute received via the graphical interface and one or more adjustable rules, one or more data records in the second filtered plurality of data records having a suspect relationship with one or more network assets of an entity previously identified as potentially malicious, wherein the one or more rules indicate the suspect relationship based on the first attribute and the second attribute;
• and
• cause the graphical interface to display the one or more data records with a visual appearance associated with the one or more network assets of the entity identified as potentially malicious based on the identified suspect relationship.

One or more non-transitory computer-readable media storing instructions that, when executed by one or more computing devices, cause:

• gathering a plurality of data sets from a plurality of data sources;
• receiving one or more criteria via a graphical interface, the one or more criteria used to filter the plurality of data sets into a plurality of data records;
• generating the graphical interface to display the plurality of data records;
• receiving, via the graphical interface, a first selection of a first attribute of the plurality of data records, wherein the first attribute comprises a name server attribute;
• generating the graphical interface to display a first filtered plurality of data records based on the first selection of the first attribute filtering the plurality of data records;
• receiving, via the graphical interface, a second selection of a second attribute of the first filtered plurality of data records;
• filtering the first filtered plurality of data records based on the second attribute to generate a second filtered plurality of data records;
• identifying, using the first attribute and the second attribute received via the graphical interface and one or more adjustable rules, one or more data records in the second filtered plurality of data records having a suspect relationship with one or more network assets of an entity previously identified as potentially malicious, wherein the one or more rules indicate the suspect relationship based on the first attribute and the second attribute;
• and
• causing the graphical interface to display the one or more data records with a visual appearance associated with the one or more network assets of the entity identified as potentially malicious based on the identified suspect relationship.