Generating a network security policy based on a user identity associated with malicious behavior

A device, comprising:

• one or more memories;
• and
• one or more processors to:
• receive data identifying malicious behavior by a compromised endpoint device associated with a network;
• receive user identity data identifying a user of the compromised endpoint device associated with the network;
• receive endpoint device data identifying the compromised endpoint device and other endpoint devices associated with the network;
• receive network device data identifying network devices associated with the network;
• utilize the data identifying malicious behavior, the user identity data, and the endpoint device data to generate, based on an identity of the user, a security policy to isolate the malicious behaviors,
• wherein the one or more processors, to utilize the data identifying malicious behavior, the user identity data, and the endpoint device data to generate the security policy, are to generate a first security rule for the security policy that causes the user identity data associated with the compromised endpoint device to be added to a traffic feed of the compromised endpoint device;
• cause the security policy to be provided to the network devices and the other endpoint devices based on the network device data and the endpoint device data;
• and
• cause one or more of the network devices to perform an action based on the security policy.

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• receive data identifying malicious behavior by a compromised endpoint device associated with a network;
• receive user identity data identifying a user of the compromised endpoint device associated with the network,
• wherein the user identity data includes one or more of:
• an email address associated with the user,
• an active directory username associated with the user,
• a username associated with the user, or
• a token associated with the user;
• receive endpoint device data identifying the compromised endpoint device and other endpoint devices associated with the network;
• receive network device data identifying network devices associated with the network;
• utilize the data identifying malicious behavior, the user identity data, and the endpoint device data to generate, based on an identity of the user, a security policy to isolate the malicious behavior;
• cause the security policy to be provided to the network devices and the other endpoint devices based on the network device data and the endpoint device data;
• and
• add the user identity data associated with the compromised endpoint device to a traffic feed of the compromised endpoint device to prevent traffic associated with the compromised endpoint device from reaching the network.