receiving, by a data protection controller from a security threat monitoring application communicatively coupled to the data protection controller by way of a network, event data triggered by a detection by the security threat monitoring application of a security threat against a host attached to a storage element of a storage system remote from the host;

authenticating, by the data protection controller, the event data using an authentication protocol;

analyzing, by the data protection controller, the event data, the analyzing including determining a threat classification associated with the event data, the threat classification representing a grouping of common event triggers based on severity and potential threat;

identifying, by the data protection controller based on the analyzing, a data protection policy; and

performing, by the data protection controller based on the event data and the data protection policy, a data protection operation with respect to the storage element, the data protection operation comprising: