Example systems and methods permit threat intelligence to be determined and used at a local, regional, and/or global level in a communications network. A threat intelligence system may collect traffic information from local computing systems and analyze it for malicious traffic. If a measure of malicious traffic in a local computing system is reached, mitigation actions may be taken in that local computing system. In addition, threat measures may be amplified in other local computing systems, other regions, or globally in the network, in order to more quickly react to a known threat as it may spread in a network.