1. A method of managing security on network infrastructure, comprising: receiving, by a log collector configured on a processor of a network security monitor via a first computer network, a plurality of logs of a second computer network, the plurality of logs indicative of a status of the second computer network determined by a monitoring agent executing on the second computer network; generating, by a log indexer configured on the network security monitor, indexed logs from the plurality of logs based on log format; retrieving, by the network security monitor, a list of threat indicators from a database based on a schema from a plurality of threat indicators received from a plurality of heterogeneous repositories via the first computer network, the plurality of threat indicators including at least one of an internet protocol (IP) address, a malware code sample, a malicious code sample, or an intrusion prevention system (IPS) signature; comparing, by a log correlation engine configured on the network security monitor, the list of threat indicators with the indexed logs; and generating, by a report engine configured on the network security monitor, a report based on the comparing to identify a threat.