1. A method for threat detection in a computer network, comprising: organizing into a cluster a set of intrusion detection systems; sharing IP reputation influencing information between or among at least some of the intrusion detection systems in the cluster; at a particular intrusion detection system in the cluster, processing event information local to the particular intrusion detection system and at least some of the IP reputation influencing information received from at least one other intrusion detection system in the cluster, wherein the processing is carried out in software executing in a hardware element; based on the processing, determining that given IP reputation data is indicative of a threat to the computer network, the given IP reputation data representing a cluster-wide view of IP reputation based at least in part on the shared IP reputation influencing information.