A device , comprising: one or more memories ; and one or more processors to: receive host threat feed information associated with endpoint hosts communicating with a network; tag host threats, identified by the host threat feed information, with particular identifications, receive information identifying a specific host threat to the network, wherein the information identifying the specific host threat identifies the specific host threat based on a particular identification, of the particular identifications, associated with the specific host threat; and the information identifying the specific host threat including a list of network addresses associated with the specific host threat; identify network elements, of the network, associated with the specific host threat; determine a network control system associated with the identified network elements; determine a policy enforcement group of network elements, of the identified network elements, that maps to the list of network addresses associated with the specific host threat, the network control system being associated with the policy enforcement group of network elements; determine a threat policy action to enforce for the specific host threat; and cause , via the network control system, the threat policy action to be enforced by the policy enforcement group of network elements. one or more memories ; and one or more processors to: receive host threat feed information associated with endpoint hosts communicating with a network; tag host threats, identified by the host threat feed information, with particular identifications, receive information identifying a specific host threat to the network, wherein the information identifying the specific host threat identifies the specific host threat based on a particular identification, of the particular identifications, associated with the specific host threat; and the information identifying the specific host threat including a list of network addresses associated with the specific host threat; identify network elements, of the network, associated with the specific host threat; determine a network control system associated with the identified network elements; determine a policy enforcement group of network elements, of the identified network elements, that maps to the list of network addresses associated with the specific host threat, the network control system being associated with the policy enforcement group of network elements; determine a threat policy action to enforce for the specific host threat; and cause , via the network control system, the threat policy action to be enforced by the policy enforcement group of network elements. receive host threat feed information associated with endpoint hosts communicating with a network; tag host threats, identified by the host threat feed information, with particular identifications, receive information identifying a specific host threat to the network, wherein the information identifying the specific host threat identifies the specific host threat based on a particular identification, of the particular identifications, associated with the specific host threat; and the information identifying the specific host threat including a list of network addresses associated with the specific host threat; identify network elements, of the network, associated with the specific host threat; determine a network control system associated with the identified network elements; determine a policy enforcement group of network elements, of the identified network elements, that maps to the list of network addresses associated with the specific host threat, the network control system being associated with the policy enforcement group of network elements; determine a threat policy action to enforce for the specific host threat; and cause , via the network control system, the threat policy action to be enforced by the policy enforcement group of network elements. <EOS>