Method and system for automatically curating intrusion detection signatures for workloads based on contextual attributes in an SDDC

A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for implementing an intent-based intrusion detection and prevention system in a datacenter, the datacenter comprising at least one host computer executing a plurality of machines, the program comprising sets of instructions for:

• receiving a plurality of contextual attributes associated with a set of data messages processed by the plurality of machines executing on the at least one host computer, the plurality of contextual attributes comprising contextual attributes that are not layer 2 through layer 4 attributes and that define a compute environment in which one or more workloads performed by the plurality of machines executing on the at least one host computer operate, wherein the plurality of contextual attributes is associated with a user intent;
• using the received plurality of contextual attributes to perform a filtering operation to identify, from a plurality of intrusion detection signatures, a set of intrusion detection signatures applicable to the one or more workloads;
• and
• providing the identified set of intrusion detection signatures to an intrusion detection system operating on the particular host computer for enforcement.