1. A network security system comprising: plural network sensors at plural locations operable to detect network telemetry information and stream the network telemetry information to a network location, the network telemetry information including events, each event having at least one of plural types of actor identifiers; and a precorrelation core stored in non-transitory memory and interfaced with the data source, the precorrelation core storing the network telemetry information in tables of random access memory by the types of actor identifier of each event, the precorrelation core associating events and actors by comparing actor identifiers for the tables to identify each event of different tables having common actor identifier information, wherein the network telemetry information tables include an IP address table and a type of event, the type of event is an authentication event, the precorrelation core operable to associate authentication events by dynamically assigned IP addresses; and a graphical user interface interfaced with the precorrelation core and operable to present the identified events of the different tables having common actor identifier information.