1. One or more non-transitory computer readable media that include code for execution and when executed by one or more processors causes the one or more processors to: populate, by a computing device, a process traffic mapping database with host event information associated with a network access attempt initiated by a process executing on a host, wherein the host event information includes process traffic information and program file information corresponding to a plurality of program files on the host, the plurality of program files mapped to the process in the host and including at least one executable file and at least one library module loaded by the process executing on the host; receive an inventory of program files stored on the host, wherein the inventory of program files includes identifications of new program files that have been added to the host; determine a respective trust status of each program file identified in the inventory; if a program file identified in the inventory is determined to be untrusted, obtain process traffic information corresponding to the program file from the process traffic mapping database; create a rule for the program file using the obtained process traffic information; and push the rule to a network protection device, wherein the rule is configured to allow network traffic associated with the program file to access a server subnet and to block network traffic associated with the program file from accessing a host subnet.