Network containment of compromised machines

A computing device comprising:

• one or more processors;
• and
• memory storing computer-executable instructions configured to be executed by the one or more processors to install a kernel-level security agent on the computing device with a firewall policy, but refrain from implementing the firewall policy until an instruction to contain the computing device is received, the kernel-level security agent configured to be executed by the one or more processors to:
• observe events associated with activity on the computing device;
• send the events, over a computer network, to a remote security system;
• receive, over the computer network and from the remote security system, the instruction to contain the computing device;
• execute instructions to load a user-mode component in user mode of the computing device;
• provide the firewall policy to the user-mode component;
• use the user-mode component to invoke an application programming interface (API) to implement the firewall policy;
• and
• implement the firewall policy in kernel mode of the computing device based at least in part on the API invoked using the user-mode component, wherein the firewall policy, upon enforcement, denies outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementing of the firewall policy.

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the computing device to install a kernel-level security agent on the computing device with a firewall policy, but refrain from implementing the firewall policy until an instruction to contain the computing device is received, wherein the kernel-level security agent, when executed by the one or more processors, causes the computing device to perform operations comprising:

• observing events associated with activity on the computing device;
• sending the events, over a computer network, to a remote security system;
• receiving, over the computer network and from the remote security system, the instruction to contain the computing device;
• executing instructions to load a user-mode component in user mode of the computing device;
• providing the firewall policy to the user-mode component;
• using the user-mode component to call an application programming interface (API) to implement the firewall policy;
• and
• implementing the firewall policy in kernel mode of the computing device based at least in part on the API called by the user-mode component, wherein the firewall policy, upon enforcement, denies outgoing data packets from, and incoming data packets to, the computing device that would have been allowed prior to the implementing of the firewall policy.