System security monitoring

A computing device, comprising:

• a memory comprising instructions;
• and
• a processor, connected to the memory, to execute the instructions to:
• receive netflow data from an activity collection system;
• where the netflow data comprises information corresponding to network-side activity associated with a target device;
• evaluate the netflow data based on a netflow signature to identify potentially malicious activity,
• where the netflow signature comprises information corresponding to two or more network events occurring in a particular order,
• evaluate the netflow data based on an activity watchlist to identify potentially malicious activity,
• where the activity watchlist comprises an identifier corresponding to an external activity device;
• and
• report, to another computing device, that potentially malicious activity, corresponding to the netflow data, has been detected based on the evaluation of the netflow data.

One or more non-transitory computer-readable storage media, comprising:

• one or more instructions that, when executed by a processor, cause the processor to:
• receive netflow data from an activity collection system,
• where the netflow data comprises information corresponding to network-side activity associated with a target device,
• evaluate the netflow data based on a netflow signature to identify potentially malicious activity,
• where the netflow signature comprises information corresponding to two or more network events occurring in a particular order,
• report, to another computing device, that potentially malicious activity, corresponding to the netflow data, has been detected based on the evaluation of the netflow data,
• receive feedback data associated with the potentially malicious activity, and
• update a netflow data evaluation operation based on the feedback data.