1. An apparatus, comprising: a user interface configured to receive a media access control (MAC) address of a candidate device coupled to a network and one or more credentials from a user; a memory configured to store the MAC address, the credentials from a user, and switch information, wherein the switch information comprises an Internet Protocol (IP) address of a switch coupled to candidate device and one or more ports of the switch; a network interface configured to communicate with the network; a processor communicatively coupled to the user interface, the memory, and the network interface, the processor configured to: receive the MAC address of the candidate device; determine, based on the MAC address of the candidate device, the IP address of the switch coupled to the candidate device, wherein determining the IP address of the switch comprises querying an network authentication database to determine the IP address of the switch through which the candidate device associated with the MAC address connected to the network within a predetermined recent period of time; access the switch using the switch IP address; receive the switch information from the switch; receive, using the user interface, credentials from the user and commands to disconnect the candidate device from the network; determine, based on the credentials from the user, whether the user is permitted to execute the commands; disconnect the candidate device from the network in response to determining the user is permitted to execute the commands, wherein disconnecting the candidate device from the network comprises: querying whether the switch can blackhole the candidate device or reroute traffic associated with the candidate device to a safe zone; issuing one or more commands to blackhole the candidate device using the MAC address in response to determining the switch can blackhole the candidate device; and issuing one or more commands to reroute traffic to the safe zone in response to determining the switch cannot blackhole the candidate device and the switch can reroute traffic associated with the candidate device to the safe zone; and add the MAC address of the candidate device to a blacklist following the disconnection of the candidate device from the network.