A security platform, comprising: one or more processors to: determine mapped attribute information associated with a plurality of host identifiers, the mapped attribute information including information that identifies a set of related attributes, where the set of related attributes includes at least one of: an Internet protocol, IP, address associated with a host identifier of the plurality of host identifiers, a hostname associated with the host identifier of the plurality of host identifiers, a media access control, MAC, address associated with a host identifier of the plurality of host identifiers, a username associated with the host identifier of the plurality of host identifiers, or a single sign-on username associated with the host identifier of the plurality of host identifiers; determine, based on at least one attribute of the set of related attributes of the mapped attribute information being associated with at least two other attributes each associated with a different host identifier of the plurality of host identifiers, that a host device is associated with at least two host identifiers of the plurality of host identifiers; aggregate, based on the at least two host identifiers, threat information as aggregated threat information associated with the host device; classify the host device as an infected device or a suspicious device based on the aggregated threat information, wherein an infected device is a device that is to be blocked from communicating with other devices due to being identified as a threat to other devices, and a suspicious device is a device that is permitted to continue communicating with other devices, but that is to be monitored due to engaging in suspicious activity; identify a first attribute of the at least two other attributes, associated with one of the at least two host identifiers, as a current attribute associated with the host device; and prevent communications, associated with another host device, from being blocked based on a second attribute of the at least two other attributes, previously associated with another host identifier of the at least two host identifiers and reassigned to the other host device, after identifying the first attribute as the current attribute associated with the host device. determine mapped attribute information associated with a plurality of host identifiers, the mapped attribute information including information that identifies a set of related attributes, where the set of related attributes includes at least one of: an Internet protocol, IP, address associated with a host identifier of the plurality of host identifiers, a hostname associated with the host identifier of the plurality of host identifiers, a media access control, MAC, address associated with a host identifier of the plurality of host identifiers, a username associated with the host identifier of the plurality of host identifiers, or a single sign-on username associated with the host identifier of the plurality of host identifiers; an Internet protocol, IP, address associated with a host identifier of the plurality of host identifiers, a hostname associated with the host identifier of the plurality of host identifiers, a media access control, MAC, address associated with a host identifier of the plurality of host identifiers, a username associated with the host identifier of the plurality of host identifiers, or a single sign-on username associated with the host identifier of the plurality of host identifiers; determine, based on at least one attribute of the set of related attributes of the mapped attribute information being associated with at least two other attributes each associated with a different host identifier of the plurality of host identifiers, that a host device is associated with at least two host identifiers of the plurality of host identifiers; aggregate, based on the at least two host identifiers, threat information as aggregated threat information associated with the host device; classify the host device as an infected device or a suspicious device based on the aggregated threat information, wherein an infected device is a device that is to be blocked from communicating with other devices due to being identified as a threat to other devices, and a suspicious device is a device that is permitted to continue communicating with other devices, but that is to be monitored due to engaging in suspicious activity; identify a first attribute of the at least two other attributes, associated with one of the at least two host identifiers, as a current attribute associated with the host device; and prevent communications, associated with another host device, from being blocked based on a second attribute of the at least two other attributes, previously associated with another host identifier of the at least two host identifiers and reassigned to the other host device, after identifying the first attribute as the current attribute associated with the host device.