A storage intelligence server including a collector component to receive trace data related to data requests from agent applications executing on computerized devices, a storage component within which the trace data is stored, an analytics component to analyze the trace data to identify a malicious data request in real-time, defining an identified malicious data request, and a controller component having stored thereon a plurality of rules that can update a rule of the plurality of rules or generate a new rule for inclusion in the plurality of rules responsive to the identified malicious data request, defining an active rule, and transmit the active rule to at least one of the firewall and the router.