Abstract: A network security analysis tool and related systems and methods are disclosed. The disclosed invention can accept user input to define network security threat models. The system can collect event data from one or more network devices and analyze that data for the existence of activity matching the defined threat models. The collected data can be translated into a common format for storage in a database of the invented system. The system can create threat models to track network threats found in the collected data that both partially and completely match one or more threat model definitions. The resulting threat models can be displayed on a console to show threat progression in near real time.