A method, comprising: receiving, by a gateway configured with a plurality of packet filtering rules, a plurality of packets associated with a network protected by the gateway; filtering, by the gateway configured with the plurality of packet filtering rules, each one of the plurality of packets; generating, by the gateway configured with the plurality of packet filtering rules, threat metadata associated with at least a first portion of the plurality of packets, wherein the threat metadata associated with the at least first portion of the plurality of packets comprises one or more of a type of threat, a name of the threat, an identity of a threat actor, a risk score, a threat intelligence provider identity, provenance information, or other threat metadata provided from outside sources; determining, by a broker and based on the threat metadata associated with the at least first portion of the plurality of packets, at least one of a plurality of cyber analysis systems (230, 232, 234) to process the first portion of the plurality of packets; receiving, by the at least one cyber analysis system (230, 232, 234) and from the broker, the first portion of the plurality of packets, the threat metadata associated with the first portion of the plurality of packets, and a configuration signal to configure the at least one cyber analysis system to perform a particular analysis method; determining, by the at least one cyber analysis system configured according to the configuration signal, based on packet data, and based on the threat metadata associated with the packet data, at least one protection action for at least a second portion of the plurality of packets; and processing, based on the determined at least one protection action, the second portion of the plurality of packets, wherein the determined at least one protection action is implemented according to conditions defined by the plurality of packet filtering rules. receiving, by a gateway configured with a plurality of packet filtering rules, a plurality of packets associated with a network protected by the gateway; filtering, by the gateway configured with the plurality of packet filtering rules, each one of the plurality of packets; generating, by the gateway configured with the plurality of packet filtering rules, threat metadata associated with at least a first portion of the plurality of packets, wherein the threat metadata associated with the at least first portion of the plurality of packets comprises one or more of a type of threat, a name of the threat, an identity of a threat actor, a risk score, a threat intelligence provider identity, provenance information, or other threat metadata provided from outside sources; determining, by a broker and based on the threat metadata associated with the at least first portion of the plurality of packets, at least one of a plurality of cyber analysis systems (230, 232, 234) to process the first portion of the plurality of packets; receiving, by the at least one cyber analysis system (230, 232, 234) and from the broker, the first portion of the plurality of packets, the threat metadata associated with the first portion of the plurality of packets, and a configuration signal to configure the at least one cyber analysis system to perform a particular analysis method; determining, by the at least one cyber analysis system configured according to the configuration signal, based on packet data, and based on the threat metadata associated with the packet data, at least one protection action for at least a second portion of the plurality of packets; and processing, based on the determined at least one protection action, the second portion of the plurality of packets, wherein the determined at least one protection action is implemented according to conditions defined by the plurality of packet filtering rules.