1. An apparatus comprising at least one computer, memory and instructions stored on non-transitory machine readable media, the instructions when executed to cause the at least one computer to: receive information representing first network security events from third party systems, said information for each first network security event including data identifying a source of the respective first network security event; automatically update content of a database stored in the memory responsive to the received information; receive a communication from one of the third party systems which identifies a second network security event, said communication including data identifying a source of the second network security event; search the database to detect correlation between the content of the database and the second network security event; in the event of correlation between the content of the database and the second network security event, determine a threat level associated with the second network security event based on the information representing the first network security events received from the third party systems; and transmit a reply message to the one of the third party systems which sent the communication, in a manner such that the reply message conveys the calculated threat level.