Tracking host threats in a network and enforcing threat policy actions for the host threats

A device, comprising:

• one or more memories;
• and
• one or more processors, communicatively coupled to the one or more memories, configured to:
• generate, based on host threat feed information, network segment information, and endpoint host session information associated with a network, a data structure that includes:
• information identifying host threat feeds associated with endpoint hosts communicating with the network, and
• information associating a plurality of network segments identified in the network segment information with sessions associated with the endpoint hosts;
• update the data structure based on a change in a state of a session associated with at least one endpoint host of the endpoint hosts;
• identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed location within at least one network segment of the plurality of network segments;
• automatically determine a threat policy action to enforce for the particular endpoint host that is triggered by the changed location within the at least one network segment;
• and
• cause the threat policy action to be enforced, by the network, for the particular endpoint host.

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• generate a data structure of endpoint hosts connected that are each connected to a network and at least one network segment, of a plurality of network segments, of the network;
• update the data structure based on a change in a session associated with at least one endpoint host of the endpoint hosts;
• identify, based on the data structure, a particular endpoint host, of the endpoint hosts, that changed location within the at least one network segment;
• automatically determine an action to enforce for the particular endpoint host that is triggered by the changed location within the at least one network segment;
• identify a network control system associated with the particular endpoint host,
• wherein the network control system controls the network segments associated with the particular endpoint host;
• and
• cause, by the network control system, the action to be enforced for the particular endpoint host.