Cybersecurity investigation tools utilizing information graphs

Example apparatus disclosed herein to perform a cybersecurity investigation include a graph generator to iteratively generate an information graph based on investigative data in response to detection of a threat alert in a monitored network, the investigative data accessed from information sources based on a set of information seeker tools, the information graph generated based on a graph schema specifying possible relationships between the information seeker tools. Example apparatus also include a pattern recognizer to traverse the information graph to identify a path in the information graph matching a pattern from the graph schema associated with a cybersecurity threat. Example apparatus further include a user interface to output the path identified in the information graph and the cybersecurity threat to an output device.