Aggregating network security data for export

A method for finding information relevant to network security incidents and obtaining aggregated results for transmission, the method comprising:

• receiving, at a computing device located within a private network, a message sent from a server located outside of the private network, the message including an observable;
• invoking, within the private network, a search of data associated with the private network to obtain a search result that includes data matching the observable;
• aggregating, within the private network, data from the search result that matches the observable to obtain aggregated data;
• generating, based on the aggregated data, a report that includes an indication of the observable, a count of occurrences of the observable, and identification of one or more components associated with the observable;
• and
• transmitting the report to the server.

A system operable to gather information relevant to network security incidents, the system comprising:

• a network interface that is connected to a first network, wherein the first network is outside of a private network;
• a memory;
• and
• a processor, wherein the memory includes instructions executable by the processor to cause the system to:
• transmit, using the network interface, a message to an agent device connected to a private network, the message including an observable;
• receive, using the network interface, a report from the agent device based on a search of data associated with the private network, wherein the report includes an indication of the observable, a count of occurrences of the observable, and identification of one or more components associated with the observable;
• and
• store data associating the one or more components with the observable.