1. A system for sharing security information, the system comprising: a plurality of entities, wherein each entity of the plurality of entities comprises a network of computing devices; and one or more computing devices programmed, via executable code instructions, to: share a first plurality of security attack data, the first plurality of security attack data comprising information regarding one or more first security attacks; receive a ruleset from a first entity of the plurality of entities, the ruleset comprising instructions selectably applicable by an entity of the plurality of entities to detect one or more security attacks, wherein the ruleset is generated by the first entity, and wherein the ruleset is associated with the first plurality of security attack data; and apply the ruleset at a second entity of the plurality of entities to identify malicious behavior of a potential or actual security attack, wherein applying the ruleset comprises: identifying a plurality of network communications associated with a network of computing devices of the second entity, wherein the plurality of network communications are from the network of computing devices of the second entity to an external computing device; identifying an elapsed time between at least two communications of the plurality of network communications; and determining that the elapsed time is within a predetermined time interval, wherein said determination indicates beaconing behavior.
1. A system for sharing security information, the system comprising: a plurality of entities, wherein each entity of the plurality of entities comprises a network of computing devices; and one or more computing devices programmed, via executable code instructions, to: share a first plurality of security attack data, the first plurality of security attack data comprising information regarding one or more first security attacks; receive a ruleset from a first entity of the plurality of entities, the ruleset comprising instructions selectably applicable by an entity of the plurality of entities to detect one or more security attacks, wherein the ruleset is generated by the first entity, and wherein the ruleset is associated with the first plurality of security attack data; and apply the ruleset at a second entity of the plurality of entities to identify malicious behavior of a potential or actual security attack, wherein applying the ruleset comprises: identifying a plurality of network communications associated with a network of computing devices of the second entity, wherein the plurality of network communications are from the network of computing devices of the second entity to an external computing device; identifying an elapsed time between at least two communications of the plurality of network communications; and determining that the elapsed time is within a predetermined time interval, wherein said determination indicates beaconing behavior. 5. The system of claim 1 , wherein application of the ruleset at the second entity further comprises identifying an external IP address associated with the potential or actual security attack.