Network isolation by policy compliance evaluation

A non-transitory computer readable storage medium comprising instructions which when executed by a processor cause the processor to perform the steps of:

• responsive to determining that network traffic detected by an internal network comprising a plurality of nodes introduces an above-threshold level of risk to the internal network:
• identifying a set of the plurality of nodes corresponding to the network traffic that introduces the above-threshold level of risk;
• and
• isolating the set of nodes by instructing a domain name system (DNS) server to prevent resolution of DNS requests for IP addresses corresponding to the set of nodes until a simulation of the network traffic and effects of the network traffic indicates that the risk introduced by the network traffic falls below the threshold level of risk.

A system comprising:

• a plurality of nodes within an internal network, each comprising one or more hardware processors and configured to receive network traffic;
• and
• an operator node of the internal network, the operator node configured to:
• responsive to determining that network traffic detected by the internal network introduces an above-threshold level of risk to the internal network:
• identifying a set of the plurality of nodes corresponding to the network traffic that introduces the above-threshold level of risk;
• and
• isolating the set of nodes by instructing a domain name system (DNS) server to prevent resolution of DNS requests for IP addresses corresponding to the set of nodes until a simulation of the network traffic and effects of the network traffic indicates that the risk introduced by the network traffic falls below the threshold level of risk.