A centralized security management system (CSMS) is provided to monitor a network to detect and mitigate attacks in or to the network. The CSMS includes a variety of devices located throughout the network to collect and synthesize data collected or obtained from devices operating in the network. The collected data is analyzed using behavioral engines or other software algorithms to develop trends for a normal and abnormal operating condition. The abnormal operating conditions are analyzed further to determine attacks to the devices or the network. Based on the attacks, a mitigation scheme is implemented to remove or reduce the attacks.