1. A method comprising: processing data received from a database at a computing device to provide an analysis of network traffic; creating a set of network related indicators of compromise from the processed data at the computing device, said set associated with a malicious network operation; identifying at the computing device, samples comprising at least one of the indicators of compromise in said set; creating sub-clusters of said samples at the computing device, wherein creating sub-clusters comprises retrieving sandbox information for said samples for use in creating said sub-clusters; and selecting at the computing device, one of said samples from one of said sub-clusters for additional malware sample analysis and associating results of said additional malware sample analysis with other of said samples from the sub-cluster to provide information for use in malware detection; wherein results from the analysis of network traffic are interconnected with the sandbox information to create said subclusters of said samples.