Techniques for sharing network security event information

An apparatus instructions stored on non-transitory machine readable media, the instructions when executed to cause at least one computer to:

• receive information representing first network security events from third party systems, said information for each first network security event including data identifying a source of the respective first network security event;
• automatically update content of a database stored responsive to the received information;
• receive a communication from one of the third party systems which identifies a second network security event, said communication including data identifying a source of the second network security event;
• initiate a search of the database to detect correlation between the content of the database and the second network security event;
• in the event of correlation between the content of the database and the second network security event, determine a threat level associated with the second network security event based on the information representing the first network security events received from the third party systems;
• and
• transmit a reply message to the one of the third party systems which sent the communication, in a manner such that the reply message conveys the calculated threat level.

A method, comprising:

• receiving with a computer from over a wide area network information representing first network security events from third party systems, said information for each first network security event including data identifying a source of the respective first network security event;
• automatically updating content of a database using a computer in responsive to the received information;
• receiving with a computer a communication from one of the third party systems which identifies a second network security event, said communication including data identifying a source of the second network security event;
• automatically searching the database to detect correlation between the content of the database and the second network security event;
• in the event of correlation between the content of the database and the second network security event, automatically determining a threat level associated with the second network security event based on the information representing the first network security events received from the third party systems;
• and
• automatically transmitting a reply message to the one of the third party systems which sent the communication, in a manner such that the reply message conveys the calculated threat level.