A building management system includes one or more computer-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to receive threat events from one or more data sources, each threat event including a description and for each threat event determine whether the description for the threat event corresponds to one of a multiple predefined threat categories, generate a standardized threat object for the threat event using the corresponding predefined threat category, and in response to determining the description does not correspond to one of the predefined threat categories, process the description using a natural language processing engine to identify one of the predefined threat categories to be assigned to the threat event and generate a standardized threat object for the threat event using the predefined threat category identified by the natural language processing engine.