Applying conditional policies on a network

A method comprising:

• receiving, by a computing system, information about events occurring on a network;
• correlating, by the computing system, each of the events to one of a plurality of compute entities on the network;
• creating, by the computing system and based on the correlated events, a profile for each of the plurality of compute entities;
• determining, by the computing system and for each compute entity of the plurality of compute entities, a threat score, wherein the threat score for each of the plurality of compute entities is based on the profile for each respective compute entity;
• evaluating, by the computing system and based on the threat score for a compute entity of the plurality of compute entities, a conditional policy governing allowed operations for the compute entity;
• and
• configuring, by the computing system and based on the evaluation, the network to enforce the conditional policy for the compute entity.

Non-transitory computer-readable media comprising instructions that, when executed, cause processing circuitry of a computing system to:

• receive information about events occurring on a network;
• correlate the events to each of a plurality of compute entities on the network;
• create a profile, based on the correlated events, for each of the plurality of compute entities;
• determine, based on the profile and a batch of new events, a threat score for each of the plurality of compute entities;
• evaluate, based on the threat score for a compute entity of the plurality of compute entities, a conditional policy governing allowed operations for the compute entity;
• and
• configure the network, based on the evaluation, to enforce the conditional policy for the compute entity.