A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing device for handling network threats, the machine-readable storage medium comprising instructions to cause the hardware processor to: receive, from a threat detector, threat data associated with a particular network device included in a plurality of network devices operating on a network; identify, based on the threat data, a responsive playbook from a plurality of predefined playbooks, each of the plurality of predefined playbooks including instructions for handling threat data; identify, based on the threat data, a particular analytics operation specified in the responsive playbook for assisting with remediation of a threat associated with the threat data; identify, based on the threat data, additional data specified in the responsive playbook for performing the particular analytics operation, the additional data being a type of data not being collected, by the plurality of network devices, at the time of receipt of the threat data; provide a collection device with instructions to cause reconfiguration of at least one of the plurality of network devices, the reconfiguration causing each of the reconfigured devices to i) collect the additional data, and ii) provide the additional data to an analytics device; and receive, from the analytics device, particular analytics results of the particular analytics operation, wherein the instructions further cause the hardware processor to: identify, based on the particular analytics results, a second playbook from the plurality of predefined playbooks, the second playbook being different from the responsive playbook; provide the collection device with instructions to cause reconfiguration of at least one of the plurality of network devices, the reconfiguration causing each of the reconfigured devices to i) collect secondary data specified by the second playbook, and ii) provide the secondary data to the analytics device; receive second analytics results from the analytics device; and provide the collection device with instructions to cause remediation of the threat, the instructions being based on the particular analytics results and the second analytics results. receive, from a threat detector, threat data associated with a particular network device included in a plurality of network devices operating on a network; identify, based on the threat data, a responsive playbook from a plurality of predefined playbooks, each of the plurality of predefined playbooks including instructions for handling threat data; identify, based on the threat data, a particular analytics operation specified in the responsive playbook for assisting with remediation of a threat associated with the threat data; identify, based on the threat data, additional data specified in the responsive playbook for performing the particular analytics operation, the additional data being a type of data not being collected, by the plurality of network devices, at the time of receipt of the threat data; provide a collection device with instructions to cause reconfiguration of at least one of the plurality of network devices, the reconfiguration causing each of the reconfigured devices to i) collect the additional data, and ii) provide the additional data to an analytics device; and receive, from the analytics device, particular analytics results of the particular analytics operation, identify, based on the particular analytics results, a second playbook from the plurality of predefined playbooks, the second playbook being different from the responsive playbook; provide the collection device with instructions to cause reconfiguration of at least one of the plurality of network devices, the reconfiguration causing each of the reconfigured devices to i) collect secondary data specified by the second playbook, and ii) provide the secondary data to the analytics device; receive second analytics results from the analytics device; and provide the collection device with instructions to cause remediation of the threat, the instructions being based on the particular analytics results and the second analytics results.