1. A method, comprising: detecting, at a device in a network, a network attack using aggregated metrics for a set of traffic data; causing, by the device, the traffic data to be clustered into a set of traffic data clusters, in response to detecting the network attack, wherein the traffic is clustered by providing the traffic data to a clustering device in the network, and the clustering device uses the set of traffic data as input to a clustering process to generate the set of traffic data clusters; providing, by the device, an indication of an attack type for the detected attack and a description for the set of traffic data to a clustering search engine; receiving, from the clustering search engine, an availability notification that identifies the clustering device, in response to providing the indication of the attack type for the detected attack and the description for the set of traffic data to the clustering search engine, wherein the clustering search engine selects the clustering device based on the attack type and the description for the set of traffic data; causing, by the device, the clustering device to analyze the traffic data clusters; and causing, by the device, the traffic data clusters to be segregated into a set of one or more attack-related clusters and into a set of one or more clusters related to normal traffic based on an analysis of the clusters by the clustering device.