1. A method comprising: providing an application firewall configured to provide conditional, rule-based access to network resources by an application executing on an endpoint; processing the application on the endpoint; coloring the application in response to a first observed action with a descriptor of a context for the first observed action, the context including one or more attributes selected for a relevance to threat detection; applying a rule dependent on the descriptor in response to a second observed action of the application to detect a reportable event; and limiting access by the application to a network resource with the application firewall based on the reportable event.