US Patent 10887333 Multi-tenant threat intelligence service

Systems for providing a multi-tenant threat intelligence service are provided. The system receives threat information from a user including IP addresses, and universal threat information including IP addresses. Modify an in-memory IP address tree using IP addresses received from the user and included in the universal threat information. Compare IP addresses from logs of network activity associated with the user to the in-memory IP address tree, and identify IP addresses included in the IP address tree. Cause matching IP addresses to be sent to the user as representing potentially malicious network activity.