1. A method, comprising: detecting a threat originating from a first node having a source address in a network; applying a local firewall policy to block connections with the source address; broadcasting an alert to a second node in the network; and applying a remote firewall policy to block outgoing connections from the first node.