Tracking host threats in a network and enforcing threat policy actions for the host threats

1. A device, comprising:

one or more memories; and

one or more processors to:

receive network topology information associated with a network identifying capabilities of network elements of the network;

receive network segment information identifying network segments associated with the network;

receive endpoint host session information identifying sessions associated with endpoint hosts communicating with the network;

generate, based on the network segment information and the endpoint host session information, a data structure that includes information associating the network segments with the sessions associated with the endpoint hosts;

update the data structure based on changes in the sessions associated with the endpoint hosts and based on changes in locations of the endpoint hosts within the network segments,

wherein the data structure indicates a status associated with each session of the sessions associated with the endpoint hosts,

the status associated with each session being one of:

 an inactive status, or

 an active status, and

wherein the data structure includes information identifying sessions associated with the endpoint hosts having the inactive status;

identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed locations within the network segments;

determine a threat policy action to enforce for the particular endpoint host; and

identify network control systems associated with the endpoint hosts,

wherein the network control systems control a network segment associated with the endpoint hosts;

add, to the data structure, information identifying the network control systems associated with the endpoint hosts; and

cause the threat policy action to be enforced, by one or more of the network control systems and based on the data structure, for the particular endpoint host.

2. The device of claim 1 , wherein the one or more processors are further to:

generate, based on the network topology information, another data structure that includes information identifying the capabilities of the network elements of the network, and

wherein the one or more processors, when causing the threat policy action to be enforced, are to:

cause the threat policy action to be enforced, by one or more network elements of the network elements, based on the other data structure.

3. The device of claim 1 , wherein the one or more processors are further to:

receive host threat feed information associated with the endpoint hosts; and

add, to the data structure and based on the host threat feed information, information identifying host threat feeds associated with the endpoint hosts.

4. The device of claim 1 , wherein the one or more processors are further to:

receive host threat feed information associated with the endpoint hosts;

cause, based on the host threat feed information and based on the threat policy action, host threat traffic external to the network to be blocked at a perimeter network element of the network; and

cause, based on the host threat feed information and based on the threat policy action, host threat traffic internal to the network to be blocked at a switching layer of the network.

5. The device of claim 1 , wherein the one or more processors are further to:

receive host threat feed information associated with the endpoint hosts; and

tag host threats, identified by the host threat feed information, with particular identifications, and

wherein the one or more processors, when determining the threat policy action, are to:

determine the threat policy action based on a particular identification, of the particular identifications, associated with the particular endpoint host.

6. The device of claim 5 , wherein the one or more processors are further to:

monitor host threat traffic across the network based on the particular identifications.

7. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors, cause the one or more processors to:

receive network topology information associated with a network identifying capabilities of network elements of the network;

receive host threat feed information associated with endpoint hosts communicating with a network;

receive network segment information identifying network segments associated with the network;

receive endpoint host session information identifying sessions associated with the endpoint hosts;

generate, based on the host threat feed information, the network segment information, and the endpoint host session information, a data structure that includes:

information identifying host threat feeds associated with the endpoint hosts, and

information associating the network segments with the sessions associated with the endpoint hosts,

wherein the data structure indicates a status associated with each session of the sessions associated with the endpoint hosts,

the status associated with each session being one of:

 an inactive status, or

 an active status, and

wherein the data structure includes information identifying sessions associated with the endpoint hosts having the inactive status;

update the data structure based on changes in the sessions associated with the endpoint hosts and based on changes in locations of the endpoint hosts within the network segments;

identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed locations within the network segments;

determine a threat policy action to enforce for the particular endpoint host;

identify network control systems associated with the endpoint hosts,

wherein the network control systems control a network segment associated with the endpoint hosts;

add, to the data structure, information identifying the network control systems associated with the endpoint hosts; and

cause the threat policy action to be enforced, by one or more of the network control systems and based on the data structure, for the particular endpoint host.

8. The non-transitory computer-readable medium of claim 7 , wherein the host threat feed information includes information associated with malware.

9. The non-transitory computer-readable medium of claim 7 , wherein the instructions further comprise:

one or more instructions that, when executed by the one or more processors, cause the one or more processors to:

generate, based on the network topology information, another data structure that includes information identifying capabilities of the network elements of the network, and

wherein the one or more instructions, that cause the one or more processors to cause the threat policy action to be enforced, cause the one or more processors to:

cause the threat policy action to be enforced, by one or more network elements of the network, based on the other data structure.

10. The non-transitory computer-readable medium of claim 7 , wherein the instructions further comprise:

one or more instructions that, when executed by the one or more processors, cause the one or more processors to:

cause, based on the host threat feed information and based on the threat policy action, host threat traffic external to the network to be blocked at a perimeter network element of the network; and

cause, based on the host threat feed information and based on the threat policy action, host threat traffic internal to the network to be blocked at a switching layer of the network.

11. The non-transitory computer-readable medium of claim 7 , wherein the instructions further comprise:

one or more instructions that, when executed by the one or more processors, cause the one or more processors to:

tag host threats, identified by the host threat feed information, with particular identifications,

each of the particular identifications being based on one of:

a media access control (MAC) address,

session information, or

a hardware identifier associated with one of the endpoint hosts, and

wherein the one or more instructions, that cause the one or more processors to determine the threat policy action, cause the one or more processors to:

determine the threat policy action based on a particular identification, of the particular identifications, associated with the particular endpoint host.

12. The non-transitory computer-readable medium of claim 11 , wherein the instructions further comprise:

one or more instructions that, when executed by the one or more processors, cause the one or more processors to:

monitor host threat traffic across the network based on the particular identifications; and

provide information associated with the host threat traffic to a management device.

13. A method, comprising:

receiving, by a device, network topology information associated with a network identifying capabilities of network elements of the network;

receiving, by the device, network segment information identifying network segments associated with the network;

receiving, by the device, endpoint host session information identifying sessions associated with endpoint hosts communicating with the network;

generating, by the device and based on the network topology information, the network segment information, and the endpoint host session information, a data structure that includes information associating the network segments with the sessions associated with the endpoint hosts,

wherein the data structure indicates a status associated with each session of the sessions associated with the endpoint hosts,

the status associated with each session being one of:

an inactive status, or

an active status, and

wherein the data structure includes information identifying sessions associated with the endpoint hosts having the inactive status;

updating, by the device, the data structure based on changes in the sessions associated with the endpoint hosts and based on changes in locations of the endpoint hosts within the network segments;

identifying, by the device and based on the data structure, a particular endpoint host, of the endpoint hosts, that changed locations within the network segments;

determining, by the device, a threat policy action to enforce for the particular endpoint host;

identifying, by the device, network control systems associated with the endpoint hosts,

wherein the network control systems control a network segment associated with the endpoint hosts;

adding, by the device and to the data structure, information identifying the network control systems associated with the endpoint hosts; and

causing, by the device, the threat policy action to be enforced, by one or more of the network control systems and based on the data structure, for the particular endpoint host.

14. The method of claim 13 , further comprising:

receiving host threat feed information associated with the endpoint hosts; and

adding, to the data structure and based on the host threat feed information, information identifying host threat feeds associated with the endpoint hosts.

15. The method of claim 13 , further comprising:

receiving host threat feed information associated with the endpoint hosts;

causing, based on the host threat feed information and based on the threat policy action, host threat traffic external to the network to be blocked at a perimeter network element of the network; and

causing, based on the host threat feed information and based on the threat policy action, host threat traffic internal to the network to be blocked at a switching layer of the network.

16. The method of claim 13 , further comprising:

receiving host threat feed information associated with the endpoint hosts; and

tagging host threats, identified by the host threat feed information, with particular identifications, and

wherein determining the threat policy action includes:

determining the threat policy action based on a particular identification, of the particular identifications, associated with the particular endpoint host.

17. The method of claim 16 , further comprising:

monitoring host threat traffic across the network based on the particular identifications; and

providing information associated with the host threat traffic to a management device to prevent duplicate analysis of the host threat traffic by the management device.

18. The method of claim 13 , wherein one or more of the network elements are associated with different vendors.

19. The device of claim 1 , wherein the one or more processors are further to:

determine new threat policy actions to enforce for endpoint hosts based on changes in locations of the endpoint hosts within the network segments.

20. The non-transitory computer-readable medium of claim 7 , wherein the instructions further comprise:

one or more instructions that, when executed by the one or more processors, cause the one or more processors to:

determine new threat policy actions to enforce for endpoint hosts based on changes in locations of the endpoint hosts within the network segments.