1. A method, comprising: receiving a reputation value based on a hash of a file attempting to establish a network connection and on a network address of a remote end of the network connection; and taking a policy action on the network connection if the reputation value indicates the hash or the network address is associated with malicious activity, wherein the reputation value is based on a file reputation associated with the hash and on a connection reputation associated with the network address of the remote end of the network connection.