Systems and methods for network security

A system comprising:

• a network comprising multiple computing nodes;
• and
• a processor-based controller unit configured to:
• monitor dataflow streams in the network;
• determine network security characteristics for a dataflow stream, from the monitored dataflow streams, relating to security, authentication, and access events for accessing, via the dataflow stream, one or more of the multiple computing nodes of the network;
• determine potential violations by the dataflow stream of one or more security policies defined for operation of the network, access functionality for the network, or identity attributes used by the network, based, at least in part, on the determined network security characteristics for the dataflow stream, and based on network-operation data comprising one or more of network security data, network identity data, and network access data, with the network-operation data being stored in one or more data storage units in the network, and configured to manage network access and operation for the multiple computing nodes of the network;
• and
• perform one or more mitigation actions in response to a determination of a security policy violation by the dataflow stream;
• wherein the controller unit configured to perform the one or more mitigation actions is configured to:
• identify one or more security violations corresponding to the determined security policy violation by the dataflow stream;
• and
• invoke one or more processes, selected from a plurality of pre-defined playbook processes implementing security access modifications applied to target dataflow streams, to modify security and access requirements responsive to the identified security violations.

Non-transitory computer-readable media comprising computer instructions executable on one or more processor-based devices to:

• monitor dataflow streams in a network comprising multiple computing nodes;
• determine network security characteristics for a dataflow stream, from the monitored dataflow streams, relating to security, authentication, and access events for accessing, via the dataflow stream, one or more of the multiple nodes of the network;
• determine potential violations by the dataflow stream of one or more security policies defined for operation of the network, access functionality for the network, or identity attributes used by the network, based, at least in part, on the determined network security characteristics for the dataflow stream, and based on network-operation data comprising one or more of network security data, network identity data, and network access data, with the network-operation data being stored in one or more data storage units in the network, and configured to manage network access and operation for the multiple computing nodes of the network;
• and
• perform one or more mitigation actions in response to a determination of a security policy violation by the dataflow stream;
• wherein the computer instructions that cause the one or more processor-based devices to perform the one or more mitigation actions include one or more instructions executable on the one or more processor-based devices to:
• identify one or more security violations corresponding to the determined security policy violation by the dataflow stream;
• and
• invoke one or more processes, selected from a plurality of pre-defined playbook processes implementing security access modifications applied to target dataflow streams, to modify security and access requirements responsive to the identified security violations.