Tracking host threats in a network and enforcing threat policy actions for the host threats

1. A method, comprising:

generating, by a device, a data structure of endpoint hosts that are each connected to a network and at least one network segment, of a plurality of network segments, of the network;

updating, by the device, the data structure based on a change in a state of a session associated with at least one endpoint host, of the endpoint hosts;

identifying, by the device and based on the data structure, a particular endpoint host, of the endpoint hosts, that changed location within the at least one network segment;

automatically determining, by the device, an action to enforce for the particular endpoint host that is triggered by the changed location within the at least one network segment;

identifying, by the device, a network control system that controls the at least one network segment associated with the particular endpoint host; and

causing, by the device, the action to be enforced, by the network control system, for the particular endpoint host.

2. The method of claim 1 , wherein the data structure is generated based on network topology information.

3. The method of claim 2 , further comprising:

processing the network topology information to determine capabilities associated with the endpoint hosts; and

storing information identifying the capabilities associated with the endpoint hosts in the data structure.

4. The method of claim 3 , wherein the network topology information is processed utilizing one or more artificial intelligence models.

5. The method of claim 1 , wherein identifying the network control system comprises:

identifying the network control system based on matching the particular endpoint host with a specific network element.

6. The method of claim 1 , wherein the action includes at least one of:

blocking endpoint host traffic at perimeter network devices of the network for external host threat traffic, or

blocking endpoint host traffic at a switching layer of the network for internal host threat traffic.

7. The method of claim 1 , further comprising:

receiving host threat feed information associated with the endpoint hosts; and

tagging host threats, identified by the host threat feed information, with particular identifications, and

wherein determining the action to be enforced comprises:

determining the action to be enforced based on a particular identification, of the particular identifications, associated with the particular endpoint host.

8. A device, comprising:

one or more memories; and

one or more processors, communicatively coupled to the one or more memories, configured to:

generate, based on host threat feed information, network segment information, and endpoint host session information associated with a network, a data structure that includes:

information identifying host threat feeds associated with endpoint hosts communicating with the network, and

information associating a plurality of network segments identified in the network segment information with sessions associated with the endpoint hosts;

update the data structure based on a change in a state of a session associated with at least one endpoint host of the endpoint hosts;

identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed location within at least one network segment of the plurality of network segments;

automatically determine a threat policy action to enforce for the particular endpoint host that is triggered by the changed location within the at least one network segment; and

cause the threat policy action to be enforced, by the network, for the particular endpoint host.

9. The device of claim 8 , wherein the one or more processors are further to:

trigger an automatic enforcement of a new threat policy change based on the changed location.

10. The device of claim 8 , wherein the one or more processors are further to:

provide, to a management device, information identifying endpoint host threats for updating threat feeds with current unique host identifiers.

11. The device of claim 8 , wherein the one or more processors are further to:

generate another data structure of network elements based on network topology information associated with the network;

determine capabilities associated with the network elements based on the network topology information; and

store information identifying the capabilities associated with the network elements in the other data structure.

12. The device of claim 8 , wherein the one or more processors are further to:

identify a network control system associated with the particular endpoint host; and

add, to the data structure, information identifying the network control system associated with the particular endpoint host, and

wherein the one or more processors, when causing the threat policy action to be enforced, are to:

cause the threat policy action to be enforced, by the network control system, based on the data structure.

13. The device of claim 8 , wherein the one or more processors are further to:

tag host threats, identified by host threat feed information, with particular identifications,

each of the particular identifications being based on one of:

a media access control (MAC) address,

session information, or

a hardware identifier associated with one of the endpoint hosts, and

wherein the one or more processors, when determining the threat policy action, are to:

determine the threat policy action based on a particular identification, of the particular identifications, associated with the particular endpoint host.

14. The device of claim 13 , wherein the one or more processors are further to:

monitor host threat traffic across the network based on the particular identifications; and

provide information associated with the host threat traffic to a management device.

15. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

generate a data structure of endpoint hosts connected that are each connected to a network and at least one network segment, of a plurality of network segments, of the network;

update the data structure based on a change in a session associated with at least one endpoint host of the endpoint hosts;

identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed location within the at least one network segment;

automatically determine an action to enforce for the particular endpoint host that is triggered by the changed location within the at least one network segment;

identify a network control system associated with the particular endpoint host,

wherein the network control system controls the network segments associated with the particular endpoint host; and

cause, by the network control system, the action to be enforced for the particular endpoint host.

16. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

tag host threats, identified by host threat feed information, with particular identifications,

each of the particular identifications being based on one of:

a media access control (MAC) address,

session information, or

a hardware identifier associated with one of the endpoint hosts, and

wherein the one or more instructions, that cause the one or more processors to determine the action to be enforced, cause the one or more processors to:

determine the action to be enforced based on a particular identification, of the particular identifications, associated with the particular endpoint host.

17. The non-transitory computer-readable medium of claim 16 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

monitor host threat traffic across the network based on the particular identifications; and

provide information associated with the host threat traffic to a management device.

18. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

receive network topology information associated with the network; and

generate, based on the network topology information, another data structure that includes information identifying capabilities of each network element of the network, and

wherein the one or more instructions, that cause the one or more processors to cause the action to be enforced, cause the one or more processors to:

cause the action to be enforced, by one or more network elements of the network, based on the other data structure.

19. The non-transitory computer-readable medium of claim 18 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

store information identifying capabilities associated with the endpoint hosts in the other data structure.

20. The non-transitory computer-readable medium of claim 19 , wherein the network topology information is processed utilizing one or more artificial intelligence models.