Segmentation management including translation

A system comprising:

• a memory;
• and
• a processing device, operatively coupled to the memory, to:
• generate a segmentation policy based on observed network traffic, the segmentation policy to restrict additional network traffic that is associated with the ovserved network traffic;
• access a segmentation policy;
• associate a tag to a entity, the tag being determined at least based on behavior and a classification of the entity;
• determine a segmentation rule based on the segmentation policy and based on the tag that is associated with the entity which is managed by the segmentation rule;
• determine an enforcement point associated with the segmentation rule, wherein the enforcement point is communicatively coupled to a network;
• translate the segmentation rule into a customized configuration associated with the enforcement point;
• wherein the customized configuration is based on a typed of the enforcement point;
• communicate the customized configuration to the enforcement point;
• access configuration information from a second enforcement point that is different from the enforcement point;
• translate the configuration information of the second enforcement point into a portion of a second segmentation policy;
• and
• store the portion of the second segmentation policy.

A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:

• generate a segmentation policy based on observed network traffic, the segmentation policy to restrict additional network traffic that is associated with the observed network traffic,
• access the segmentation policy;
• associate a tag with an entity, the tag being determined at least based on behavior and a classification of the entity;
• determine, using the processing device, a segmentation rule based on the segmentation policy and based on the tag that is associated with the entity which is managed by the segmentation rule;
• determine an enforcement point associated with the segmentation rule, wherein the enforcement point is communicatively coupled to a network;
• translate the segmentation rule into a customized configuration associated with the enforcement point, wherein the customized configuration is based on a type of the enforcement point;
• communicate the customized configuration to the enforcement point;
• access configuration information from a second enforcement point that is different from the enforcement point;
• translate the configuration information of the second enforcement point into a portion of a second segmentation policy;
• and
• store the portion of the second segmentation policy.