Abstract: Methods and systems for a network of computing devices are described. Embodiments of the present disclosure include a pipeline system that may be configured to identify a plurality of leads from amongst the computing devices by comparing data received from the computing devices to soft fingerprints. In some cases, the pipeline system may perform probing each of the plurality of leads using an emulator, and generating a threat indicator in response to the probing. Next, the pipeline system may enrich the plurality of leads in response to probing each of the plurality of leads and appending enrichment data to the threat indicator. The threat indicator and the enrichment data may be subsequently transferred to update a search cluster.