Described are methods and apparatus, including computer program products,
for mitigating against a cyber attack on a network. An indication is
received from an intrusion detection system that an event has occurred
representing a threat to the network. Upon receiving the event from the
intrusion detection system, automated processes determine a port
associated with the threat and automatically block the port.