1. An apparatus comprising at least one computer, memory and instructions stored on non-transitory machine readable media, the instructions when executed to cause the at least one computer to: receive information representing first network security events from third party systems, said information for each first network security event including data identifying a source of the respective first network security event; automatically update content of a first database stored in the memory responsive to the received information; receive a communication from one of the third party systems which identifies a second network security event, said communication including data identifying a source of the second network security event, said communication including a hash; responsive to receipt of said communication, access a second database containing cryptographic keys, each cryptographic key associated with a respective one of the third party systems, and process the communication using one or more of the cryptographic keys from the second database to detect correspondence between the hash and at least one of the cryptographic keys from the second database, wherein said communication does not identify which one of the third party systems transmitted said communication and does not identify which cryptographic key in the second database is to be used to detect correspondence; dependent on detected correspondence, search the first database to detect correlation between the content of the database and the second network security event and, in the event of correlation between the content of the first database and the second network security event, determine a threat level associated with the second network security event based on the information representing the first network security events received from the third party systems; and transmit a reply message to the one of the third party systems which sent the communication, in a manner such that the reply message conveys the calculated threat level.