A method for responding to data security threats,threats, in an organization, the method comprising: receiving, at a threat aggregator service, threat aggregator, executing on an analysis computer system, events sent from and observed by user devices within the organization, wherein each received event comprises event information, creating and/or updating threats, using the threat aggregator, based on the received events, wherein the threats include one or more events which are determined by the threat aggregator to be associated with known data security issues by comparing, in the threat aggregator, the event information of the received events and Tools/Tactics/Procedures, TTPs, of known data security issues, and appending TTPs of the known data security issues to the matching events; identifying, using an endpoint telemetry system, possible attacks upon the organization based on the threats; determining whether the possible attacks are associated with known attacks, and providing security policies that specify actions for responding to the threats; and characterized by matching, by the endpoint telemetry system, the possible attacks to records of known extraneous threats and/or false positive threats; sending, from the endpoint telemetry system to the threat aggregator, a description of the possible attacks matching the records of known extraneous threats and/or false positive threats in conjunction with a discard action; and discarding, by the threat aggregator, locally stored threats having a description matching the sent description of the possible attacks and/or discarding any subsequent events received from the user devices having a description matching the sent description of the possible attacks. receiving, at a threat aggregator service, threat aggregator, executing on an analysis computer system, events sent from and observed by user devices within the organization, wherein each received event comprises event information, creating and/or updating threats, using the threat aggregator, based on the received events, wherein the threats include one or more events which are determined by the threat aggregator to be associated with known data security issues by comparing, in the threat aggregator, the event information of the received events and Tools/Tactics/Procedures, TTPs, of known data security issues, and appending TTPs of the known data security issues to the matching events; identifying, using an endpoint telemetry system, possible attacks upon the organization based on the threats; determining whether the possible attacks are associated with known attacks, and providing security policies that specify actions for responding to the threats; and characterized by matching, by the endpoint telemetry system, the possible attacks to records of known extraneous threats and/or false positive threats; sending, from the endpoint telemetry system to the threat aggregator, a description of the possible attacks matching the records of known extraneous threats and/or false positive threats in conjunction with a discard action; and discarding, by the threat aggregator, locally stored threats having a description matching the sent description of the possible attacks and/or discarding any subsequent events received from the user devices having a description matching the sent description of the possible attacks.