1. A method, comprising: providing, by a supervisory computer network device, computer network attack observations from a first computer network device in a computer network to a user interface device regarding a potential computer network attack detected by the first computer network device; receiving, at the supervisory computer network device, a confirmation from the user interface device that confirms that a particular computer network attack observation from the first computer network device indicates that the potential computer network attack was detected correctly by the first computer network device; in response to receiving the confirmation that a potential computer network attack was detected correctly, providing, by the supervisory computer network device, computer network attack observations from one or more other computer network devices in the computer network to the user interface device; receiving, at the supervisory computer network device, one or more confirmations from the user interface device that confirms that the computer network attack observations from the one or more other computer network devices are related to the computer network attack observations from the first computer network device; and identifying, by the supervisory computer network device, the one or more other computer network devices to act as potential voters for the first computer network device in a voting-based network attack detection mechanism based on the computer network attack observations from the first computer network device and the one or more other computer network devices being related to each other.