Text this: Collection policy refining method for threat monitoring in complex network environment