According to some embodiments, a method and apparatus are provided to receive, at a central security manager located on a computer network, first network information from a first network resource associated with a first network perspective and receive, at the central security manager, second network information from a second network resource associated with a first network perspective. The first network information and the second network information are aggregated. A potential attack to the network is determined and a defensive measure is implemented in response to the potential attack to the network.