1. A method of operating an advisement system to provide security actions in a computing environment comprising a plurality of computing assets, the method comprising: in a processing system of the advisement system, identifying a security threat within the computing environment, wherein the security threat comprises an unknown process executing on an asset of the plurality of computing assets; in response to identifying the security threat, receiving state information for the security threat from the asset and one or more additional assets of the plurality of computing assets, wherein the state information comprises at least communication activity for the security threat with the one or more additional assets, and wherein the communication activity for the security threat comprises a quantity of communications initiated by the security threat with the one or more additional assets and an amount of data communicated by the security threat; determining a current state for the security threat within the computing environment based on the state information; obtaining enrichment information for the security threat; and determining one or more security actions for the security threat based on the enrichment information and the current state for the security threat.