1. A method for determining computer security threats, comprising: obtaining a possible intrusions report having indicia of a plurality of possible network intrusions; retrieving an actual intrusions report having indicia of at least one actual intrusion from a security network, wherein the security network is at least configured to utilize at least one taxonomy; comparing the possible intrusion reports with the actual intrusion reports to determine one or more false positives and one or more true positives; and updating the at least one taxonomy with at least one of the false positives and at least one of the true positives.