14. A computer implemented method comprising: receiving a ruleset at a second entity of a plurality of entities, wherein the ruleset comprises instructions selectably applicable by an entity of the plurality of entities to detect one or more security attacks, wherein the ruleset was generated by a first entity of the plurality of entities, wherein the ruleset is associated with a first plurality of security attack data, and wherein each entity of the plurality of entities comprises a network of computing devices; and applying the ruleset at the second entity to identify a potential or actual security attack at the second entity, wherein applying the ruleset comprises: identifying a plurality of network communications associated with a network of computing devices of the second entity, wherein the plurality of network communications are from the network of computing devices of the second entity to an external computing device; identifying an elapsed time between at least two communications of the plurality of network communications; and determining that the elapsed time is within a predetermined time interval, wherein said determination indicates beaconing behavior.
20. The computer implemented method of claim 14 , further comprising: accessing second security attack data associated with a second potential or actual security attack directed at the second entity; accessing redaction rules of the second entity, wherein the redaction rules are associated with at least one of: internal IP addresses, hostnames, or other identifying information of a network of computing devices of the second entity; generating modified security attack data from the second security attack data by removing any matching internal IP addresses, hostnames, or other identifying information as indicated by the redaction rules; and sharing the modified security attack data with a third entity.