Enforcing threat policy actions based on network addresses of host threats

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive host threat feed information associated with endpoint hosts communicating with a network;
• identify, from the host threat feed information, a specific host threat to the network,
• the specific host threat being caused by one of the endpoint hosts, and
• the specific host threat being associated with a list of network addresses of the network;
• identify network elements, of the network, associated with the specific host threat to the network;
• determine a network control system associated with the identified network elements;
• determine a policy enforcement group of network elements, of the identified network elements, that maps to the list of network addresses associated with the specific host threat,
• the network control system being associated with the policy enforcement group of network elements;
• determine a threat policy action to enforce for the specific host threat;
• and
• cause, via the network control system, the threat policy action to be enforced by the policy enforcement group of network elements.

A method, comprising:

• receiving, by a device, network topology information associated with a network;
• generating, by the device and based on the network topology information, a data structure that includes information identifying capabilities of each network element of the network;
• receiving, by the device, information identifying a specific host threat to the network,
• the information identifying the specific host threat including a list of network addresses associated with the specific host threat;
• identifying, by the device and based on the data structure, network elements associated with the specific host threat to the network;
• determining, by the device, a network control system associated with the identified network elements;
• determining, by the device, a policy enforcement group of network elements, of the identified network elements, that maps to the list of network addresses associated with the specific host threat,
• the network control system being associated with the policy enforcement group of network elements;
• determining, by the device, a threat policy action to enforce for the specific host threat;
• and
• causing, by the device and via the network control system, the threat policy action to be enforced by the policy enforcement group of network elements.