Network security threat intelligence sharing

A method for obtaining network security threat information, the method comprising:

• receiving a message from a central instance;
• from a computing device that is connected to a network that is outside of a private network, invoking a search of data associated with the private network, wherein the search is based on the message and the search is performed by an agent device within the private network;
• receiving a search result of the search from the agent device;
• transmitting data that is based on the search result to the central instance, wherein the central instance is configured to generate network security threat information based in part on the data that is based on the search result and share the network security threat information with a plurality of customer instances that are associated with a group of customers;
• and
• receiving an alert message from the central instance, wherein the alert message includes the network security threat information that identifies a network security threat.

A system operable to gather information relevant to network security threats, the system comprising:

• a plurality of customer instances that are configured to invoke searches of data associated with respective customer networks, wherein the searches are performed by a respective agent device in the respective customer network and wherein the customer instance is outside of the respective customer network;
• and
• a central instance that is configured to:
• store data reflecting a group of customers that share network security threat information, wherein the plurality of customer instances are respectively associated with a customer from the group of customers;
• transmit a search query to the customer instances to cause the customer instances to invoke searches of the respective customer networks;
• receive results of the searches from the customer instances;
• analyze the results of the searches to generate network security threat information describing a network security threat;
• and
• transmit alert messages that include at least some of the network security threat information describing the network security threat to the customer instances.