Dynamic, Event-Driven Traffic Control in a Managed Network

A method comprising:

• receiving, by a gateway device disposed within a managed network and communicatively coupled to a computational instance of a remote network management platform, network traffic from computing devices on the managed network, wherein the network traffic specifies destinations within the computational instance, and wherein the gateway device is configured with a list of network addresses assigned to the managed network;
• discarding, by the gateway device, a first unit of the network traffic, wherein the first unit of the network traffic has source addresses that are specified in the list;
• for a second unit of the network traffic with source addresses that are not specified by the list, the gateway device (i) encrypting, as a whole, payloads of each packet of the second unit of the network traffic, and (ii) transmitting the encrypted packets from the gateway device to the computational instance;
• receiving, by the gateway device and from a gateway controller device, an instruction to update the list to include an additional network address, wherein the additional network address is derived from security event log data that specifies the additional network address, and wherein the additional network address is assigned to a particular computing device on the managed network that is suspected of violating a security policy;
• and
• updating, by the gateway device, the list to include the additional network address.

A method comprising:

• receiving, by a gateway device disposed within a managed network and communicatively coupled to a computational instance of a remote network management platform, a representation of a particular database field or file type, wherein the computational instance contains a database that defines the particular database field or supports storage of the file type;
• receiving, by the gateway device, network traffic from computing devices on the managed network, wherein the network traffic specifies destinations within the computational instance, and wherein the gateway device is configured with a list of network addresses assigned to the managed network;
• determining, by the gateway device, that a unit of the network traffic has a source address that is not specified in the list and is to be encrypted using a first type of cryptography;
• and
• in response to determining that the unit of the network traffic has the source address that is not specified in the list, the gateway device:
• (i) parsing the unit of the network traffic for data classified in the particular database field or the file type, (ii) individually encrypting the data classified in the particular database field or the file type using a second type of cryptography, (iii) encrypting, as a whole, payloads of each packet of the unit of the network traffic using the first type of cryptography, and (iv) transmitting the encrypted packets from the gateway device to the computational instance.