1. A method, comprising: providing, by a network device, attack observations from a first node in a network to a user interface device regarding an attack detected by the first node; receiving a confirmation from the user interface device that confirms that a particular attack observation from the first node indicates that the attack was detected correctly by the first node; providing, by the network device, attack observations from one or more other nodes in the network to the user interface device; receiving one or more confirmations from the user interface device that confirms that the attack observations from the one or more other nodes are related to the attack observations from the first node; and identifying, by the network device, the one or more other nodes as potential voters for the first node in a voting-based attack detection mechanism based on the attack observations from the first node and the one or more other nodes being related.