1. A method comprising: receiving, at a central server from a first network security appliance, a first analytics set performed on the first network security appliance operated internal to a first organization; processing, at the central server, the first analytics set to obtain a recommended subsequent analytics selection; receiving, at the central server from a second network security appliance, an initial analytics selection associated with a second analytics set performed on the second network security appliance operated internal to a second organization; responsive to receiving the initial analytics selection, disseminating from the central server to the second network security appliance the recommended subsequent analytics selection, without revealing an identity of the first organization; wherein at least a portion of the first analytics set is organized in a search tree, the search tree comprising a lead value and an audit trail, the lead value representing a user token and a time, the user token being associated with one or more network administrators of the first organization performing one or more actions in the audit trail, the time being associated with performance of the one or more actions in the audit trail; and wherein the recommended subsequent analytics selection is based at least in part on: (i) a reputation of the one or more network administrators associated with the user token; and (ii) the time associated with performance of the one or more actions in the audit trail.