A system operable to obtain network security threat information, the system comprising: a memory; and one or more processors, wherein the memory includes instructions, that, when executed, are configured to cause the one or more processors to: receive a search query from a first customer instance (360, 362, 364, 610, 670, 680), wherein the search query is formed based on one or more observables of a network security incident; send a message comprising the search query to a second customer instance (360, 362, 364, 610, 670, 680) to cause the second customer instance (360, 362, 364, 610, 670, 680) to invoke a search of data of a customer network (330, 332, 334) associated with the second customer instance (360, 362, 364, 610, 670, 680) based on the message; receive a search result from the second customer instance (360, 362, 364, 610, 670, 680), wherein the search result reflects an occurrence of the one or more observables in the customer network (330, 332, 334); identify a host in the customer network (330, 332, 334) based on the search result that reflects the occurrence of the one or more observables of the customer network (330, 332, 334); and transmit an alert message to the second customer instance (360, 362, 364, 610, 670, 680) configured to cause the second customer instance to invoke a threat mitigation to block communication with the host. a memory; and one or more processors, wherein the memory includes instructions, that, when executed, are configured to cause the one or more processors to: receive a search query from a first customer instance (360, 362, 364, 610, 670, 680), wherein the search query is formed based on one or more observables of a network security incident; send a message comprising the search query to a second customer instance (360, 362, 364, 610, 670, 680) to cause the second customer instance (360, 362, 364, 610, 670, 680) to invoke a search of data of a customer network (330, 332, 334) associated with the second customer instance (360, 362, 364, 610, 670, 680) based on the message; receive a search result from the second customer instance (360, 362, 364, 610, 670, 680), wherein the search result reflects an occurrence of the one or more observables in the customer network (330, 332, 334); identify a host in the customer network (330, 332, 334) based on the search result that reflects the occurrence of the one or more observables of the customer network (330, 332, 334); and transmit an alert message to the second customer instance (360, 362, 364, 610, 670, 680) configured to cause the second customer instance to invoke a threat mitigation to block communication with the host. receive a search query from a first customer instance (360, 362, 364, 610, 670, 680), wherein the search query is formed based on one or more observables of a network security incident; send a message comprising the search query to a second customer instance (360, 362, 364, 610, 670, 680) to cause the second customer instance (360, 362, 364, 610, 670, 680) to invoke a search of data of a customer network (330, 332, 334) associated with the second customer instance (360, 362, 364, 610, 670, 680) based on the message; receive a search result from the second customer instance (360, 362, 364, 610, 670, 680), wherein the search result reflects an occurrence of the one or more observables in the customer network (330, 332, 334); identify a host in the customer network (330, 332, 334) based on the search result that reflects the occurrence of the one or more observables of the customer network (330, 332, 334); and transmit an alert message to the second customer instance (360, 362, 364, 610, 670, 680) configured to cause the second customer instance to invoke a threat mitigation to block communication with the host.