1. A method, comprising: determining a plurality of frequency ranges, wherein a particular frequency range corresponds to a proper subset of a plurality of program files, wherein the plurality of program files is associated with a greylist of program files, wherein the proper subset of the plurality of program files is associated with one or more hosts of a plurality of hosts in a network environment, wherein each of the one or more hosts includes at least one occurrence of at least one program file of the proper subset, and wherein the particular frequency range indicates a prevalence of each program file of the proper subset across the plurality of hosts; receiving an indication that the particular frequency range corresponding to the proper subset is selected; identifying a plurality of first groupings of the proper subset in response to receiving the indication that the particular frequency range corresponding to the proper subset is selected, wherein a particular first grouping of the plurality of first groupings includes one or more program files of the proper subset based on a value of a primary attribute of the one or more program files included in the particular first grouping; generating a set of first counts corresponding, respectively, to the plurality of first groupings, wherein a particular first count represents an aggregate amount of program files in the particular first grouping; receiving an indication that the particular first grouping is selected; and receiving an indication that an action is selected by a user via a user interface, wherein the action includes blocking execution of at least one program file identified in the particular first grouping, or quarantining the at least one program file identified in the particular first grouping, wherein, if the particular first grouping and the action are selected, the action is performed on the at least one program file identified in the particular first grouping.