Reuse of groups in security policy

A non-transitory machine readable medium storing a program which when executed by at least one processing unit modifies a firewall rule of a security policy implemented in a network, the program comprising sets of instructions for:

• identifying a set of compute machines to be added to a match condition for the firewall rule, wherein the match condition is expressed using one or more groups of compute machines;
• selecting a set of groups for the identified set of compute machines from a plurality of existing groups of compute machines based on a user-specified threshold indicating tolerance for inclusion of compute machines that are not in the identified set of compute machines in the selected groups;
• and
• using the selected set of groups for the match condition of the firewall rule;
• wherein the user-specified threshold balances use of existing groups against inclusion in the match condition of compute machines that are not in the identified set of compute machines.