A system comprising: one or more processors and non-transitory machine readable storage medium; a distributed environment that includes a user device, a plurality of agents, a collection bus, a policy bus, and target system having a resource; program instructions to collect data pertaining to a security event, wherein: the data includes: (i) a source that identifies a user or the user device, and (ii) a destination that identifies the target system or the resource; and the data is collected by the collection bus from at least one of the plurality of agents; program instructions to create a dynamic enforcement policy based on the data, wherein the dynamic enforcement policy includes a specification of the source, the destination, an enforcement action, and a duration for the dynamic enforcement policy to be active; and program instructions to publish the dynamic enforcement policy on the policy bus such that the plurality of agents have access to the dynamic enforcement policy, wherein during the duration for the dynamic enforcement policy to be active, the dynamic enforcement policy overwrites a static enforcement policy that includes a specification of the source and the destination, and wherein the program instructions are stored on the non-transitory machine readable storage medium for execution by the one or more processors, the system further comprising program instructions to implement the enforcement action for the security event based on the dynamic enforcement policy, wherein at least one of the plurality of agents implements the enforcement action. one or more processors and non-transitory machine readable storage medium; a distributed environment that includes a user device, a plurality of agents, a collection bus, a policy bus, and target system having a resource; program instructions to collect data pertaining to a security event, wherein: the data includes: (i) a source that identifies a user or the user device, and (ii) a destination that identifies the target system or the resource; and the data is collected by the collection bus from at least one of the plurality of agents; the data includes: (i) a source that identifies a user or the user device, and (ii) a destination that identifies the target system or the resource; and the data is collected by the collection bus from at least one of the plurality of agents; program instructions to create a dynamic enforcement policy based on the data, wherein the dynamic enforcement policy includes a specification of the source, the destination, an enforcement action, and a duration for the dynamic enforcement policy to be active; and program instructions to publish the dynamic enforcement policy on the policy bus such that the plurality of agents have access to the dynamic enforcement policy, wherein during the duration for the dynamic enforcement policy to be active, the dynamic enforcement policy overwrites a static enforcement policy that includes a specification of the source and the destination, and wherein the program instructions are stored on the non-transitory machine readable storage medium for execution by the one or more processors, the system further comprising program instructions to implement the enforcement action for the security event based on the dynamic enforcement policy, wherein at least one of the plurality of agents implements the enforcement action.