Correlating network event anomalies using active and passive external reconnaissance to identify attack information

A computer system comprising a memory, wherein the computer system is configured to execute software instructions stored on nontransitory machine-readable storage media that:

• store in the memory a representation of a first graph, wherein the representation of the first graph comprises representations of a first plurality of nodes and a first plurality of edges,
• wherein the first graph is a directed graph,
• wherein each node of the first plurality of nodes corresponds to a respective entity of a plurality of entities, and
• wherein the first plurality of edges includes at least one edge corresponding to a physical connection between entities and at least one edge corresponding to a logical connection between entities;
• process, substantially in real time, streaming data received from a plurality of devices,
• wherein the streaming data comprises information about events relating to the plurality of entities;
• process the representation of the first graph to add, subtract, or modify a node of the first graph based on the streaming data,
• process the representation of the first graph to add, subtract, or modify an edge of the first graph based on the streaming data,
• use the representation of the first graph to determine whether an event, of the events relating to the plurality of entities, is anomalous, and,
• if the event is anomalous, identify the event as a first anomalous event.