1. A system, comprising: a plurality of traffic behavior aggregation nodes that implement aggregation levels for traffic source behavior data, the aggregation nodes implemented via one or more computers comprising one or more hardware processors and configured to: receive respective indications of endpoint-specific network traffic directed to different ones of a plurality of network endpoints from a plurality of traffic sources; and generate aggregate traffic source behavior data that is maintained across aggregation levels based, at least in part, on the indications of endpoint-specific network traffic, wherein a different respective granularity of the aggregate traffic source behavior data is maintained at each of the aggregation levels; and a control plane, configured to: provide a traffic behavior indication for one or more of the traffic sources such that an action is performed with regard to at least one of the traffic sources for at least one of the network endpoints, wherein to provide the traffic behavior indication, the control plane is configured to: in response to a received request for traffic behavior data: identify one or more aggregation levels that provide a respective granularity of the aggregate traffic source behavior data that includes the requested traffic behavior data; identify at least one of the one or more traffic behavior aggregation nodes of the identified one or more aggregation levels to query for the traffic behavior data; and send a query to the identified at least one traffic behavior aggregation node to obtain the traffic behavior data.