A system, comprising: a processor configured to: receive a set of network related event data, wherein the set of network related event data includes Domain Name System related event data; receive a set of network related threat data, wherein the set of network related threat data includes DNS related threat data, wherein the DNS related threat data includes a DNS threat feed that is automatically filtered to determine a popularity of network domains associated with malware, and wherein the DNS related threat data includes DNS related threat data for a first enterprise network; filter the DNS related event data to generate a smart whitelist using the set of network related event data and the set of network related threat data, wherein the whitelist includes a subset of network domains included in the DNS related event data based on a data driven model of the DNS related event data and the DNS related threat data, and wherein the DNS related event data is automatically filtered using a classifier to exclude one or more network domains associated with malware; and periodically update the smart whitelist based on another set of network related event data and another set of network related threat data, wherein the smart whitelist is automatically and dynamically adjusted to changes in a production data environment associated with a first enterprise network; and a memory coupled to the processor and configured to provide the processor with instructions. a processor configured to: receive a set of network related event data, wherein the set of network related event data includes Domain Name System related event data; receive a set of network related threat data, wherein the set of network related threat data includes DNS related threat data, wherein the DNS related threat data includes a DNS threat feed that is automatically filtered to determine a popularity of network domains associated with malware, and wherein the DNS related threat data includes DNS related threat data for a first enterprise network; filter the DNS related event data to generate a smart whitelist using the set of network related event data and the set of network related threat data, wherein the whitelist includes a subset of network domains included in the DNS related event data based on a data driven model of the DNS related event data and the DNS related threat data, and wherein the DNS related event data is automatically filtered using a classifier to exclude one or more network domains associated with malware; and periodically update the smart whitelist based on another set of network related event data and another set of network related threat data, wherein the smart whitelist is automatically and dynamically adjusted to changes in a production data environment receive a set of network related event data, wherein the set of network related event data includes Domain Name System related event data; receive a set of network related threat data, wherein the set of network related threat data includes DNS related threat data, wherein the DNS related threat data includes a DNS threat feed that is automatically filtered to determine a popularity of network domains associated with malware, and wherein the DNS related threat data includes DNS related threat data for a first enterprise network; filter the DNS related event data to generate a smart whitelist using the set of network related event data and the set of network related threat data, wherein the whitelist includes a subset of network domains included in the DNS related event data based on a data driven model of the DNS related event data and the DNS related threat data, and wherein the DNS related event data is automatically filtered using a classifier to exclude one or more network domains associated with malware; and periodically update the smart whitelist based on another set of network related event data and another set of network related threat data, wherein the smart whitelist is automatically and dynamically adjusted to changes in a production data environment associated with a first enterprise network; and a memory coupled to the processor and configured to provide the processor with instructions.