A cyber security threat tool may detect, analyze and alert of cyber security threats in, for example, a communication network of a service provider. For example, the tool may receive network connection data associated with a plurality of network connections between a plurality of computing devices, generate, based at least in part on the network connection data, a graphical database comprising a plurality of graph nodes corresponding to the plurality of computing devices and a plurality of graph edges corresponding to the plurality of network connections and performing a database query on the graphical database to generate query results, the database query including a connection pattern to be matched by the query results generated by the performing the database query. The cyber security threat tool may then render at least a portion of the query results in a graph view and cause the graph view to be output to a user.