An index of network data is received, the index including network infrastructure data, network connection topology data and network devices data, collected in real time. Data describing one or more cybersecurity threat sources is received. Data describing communications occurring with devices within the network is received. The data describing the one or more cybersecurity threat sources and the data describing the communications occurring with devices within the network are analyzed to identify data describing possible security threats. The data describing the possible security threats is correlated with the index of network data to identify security threats to devices within the network.