1. A computer-implemented method for network data characterization, comprising: receiving network events, wherein at least some of the events include content; converting the received content into data messages, wherein at least some of the data messages include the content and metadata describing an event and the content; routing the data messages to a plurality of analyzers based on specified message criteria to which each analyzer subscribes; each of one or more analyzers that received the routed data messages analyzing the content within the data messages in order to characterize the content, wherein the one or more analyzers include at least one machine-learning analyzer that classifies the content with a confidence percentage that indicates the probability that the content is malign or the confidence that a prediction that the content is malign is correct; outputting the characterization results of the one or more analyzers; and comparing the output characterization results against a plurality of criteria to determine subsequent action to take based on the characterization results.