# US 12,224,904 B2 · Segmentation management including translation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,224,904 B2 - Document ID: US12224904B2 - Status: Granted - Kind: B2 - Application number: 17/882,723 - Filed: 2022-08-08 - Published: 2022-12-01 - Granted: 2025-02-11 - Earliest claimed: 2018-06-29 - Assignees: Forescout Technologies, Inc. - Applicants: Forescout Technologies, Inc. - Inventors: Ilya Fainberg - Web page: https://patentgrep.com/patent/US12224904B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 41/0226: Mapping or translating multiple network management protocols - H04L 41/0893: Assignment of logical groups to network elements - H04L 41/0894: Policy-based network configuration management - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/045: for graphical visualisation of monitoring data - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0263: {Rule management} - H04L 63/104: {Grouping of entities} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 43/18: Protocol analysers - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and related technologies for segmentation management are described. The segmentation management may include visualization, configuration including translation, simulation, or a combination thereof of one or more segmentation policies. In certain aspects, a segmentation policy is accessed and a segmentation rule is determined based on the segmentation policy, wherein the segmentation rule is based on a characteristic of an entity determined without the use of an agent. An enforcement point associated with the segmentation rule may be determined, where the enforcement point is communicatively coupled to a network. The segmentation rule may be translated into a configuration associated with the enforcement point and the configuration communicated to the enforcement point. ## Claims ### Claim 1 A method comprising: generating a segmentation policy based on observed network traffic, the segmentation policy to restrict additional network traffic that is associated with the observed network traffic, accessing the segmentation policy; associating a tag with an entity, the tag being determined at least based on behavior and a classification of the entity; determining a segmentation rule based on the segmentation policy and based on the tag that is associated with the entity which is managed by the segmentation rule; determining an enforcement point associated with the segmentation rule, wherein the enforcement point is communicatively coupled to a network; translating the segmentation rule into a customized configuration associated with the enforcement point, wherein the customized configuration is based on a type of the enforcement point; and communicating the customized configuration to the enforcement point; accessing configuration information from a second enforcement point that is different from the enforcement point; translating the configuration information of the second enforcement point into a portion of a second segmentation policy; and storing the portion of the second segmentation policy. ### Claim 2 (depends on 1) The method of claim 1 where generating th segmentation policy comprises: storing network traffic, wherein the network traffic comprises a plurality of communications between a plurality of devices; determining respective source and respective destinations of the communications of the network traffic; generating the segmentation policy based the respective source and respective destinations of the communications; and monitoring additional network traffic based on the segmentation policy. ### Claim 3 (depends on 2) The method of claim 2, further comprising: determining a baseline of the network traffic over a period of time. ### Claim 4 (depends on 1) The method of claim 1, further comprising: detecting the enforcement point being communicatively coupled to the network. ### Claim 5 (depends on 1) The method of claim 1, wherein the customized configuration associated with the enforcement point comprises at least one of an access control list (ACL), a firewall command, or rule or a cloud packet filtering ACL. ### Claim 6 (depends on 1) The method of claim 1, wherein the communicating the customized configuration to the enforcement point comprises at least one of an application programming interface (API), command line interface (CLI), or a simple network management protocol (SNMP) interface. ### Claim 7 (depends on 1) The method of claim 1, wherein the enforcement point is at least one of a firewall, a router, a switch, a portion of cloud infrastructure, hypervisor, software-defined networking (SDN) controller, or virtual firewall. ### Claim 8 (depends on 1) The method of claim 1 further comprising: adjusting the second segmentation policy. ### Claim 9 (depends on 1) The method of claim 1, wherein the customized configuration comprises one or more commands or configuration settings particular to the type of enforcement point. ### Claim 10 (depends on 9) The method of claim 9, wherein the tag that is associated with the entity is based on source and a destination of a communication of the entity. ### Claim 11 (depends on 1) The method of claim 1, wherein entity comprises at least one of a device, an endpoint, a virtual machine, a service, a serverless service, a container, or a user. ### Claim 12 A system comprising: a memory; and a processing device, operatively coupled to the memory, to: generate a segmentation policy based on observed network traffic, the segmentation policy to restrict additional network traffic that is associated with the ovserved network traffic; access a segmentation policy; associate a tag to a entity, the tag being determined at least based on behavior and a classification of the entity; determine a segmentation rule based on the segmentation policy and based on the tag that is associated with the entity which is managed by the segmentation rule; determine an enforcement point associated with the segmentation rule, wherein the enforcement point is communicatively coupled to a network; translate the segmentation rule into a customized configuration associated with the enforcement point; wherein the customized configuration is based on a typed of the enforcement point; communicate the customized configuration to the enforcement point; access configuration information from a second enforcement point that is different from the enforcement point; translate the configuration information of the second enforcement point into a portion of a second segmentation policy; and store the portion of the second segmentation policy. ### Claim 13 (depends on 12) The system of claim 12, wherein to generate the segmentation policy comprises to: store network traffic, wherein the network traffic comprises a plurality of communications between a plurality of devices; determine respective source and respective destinations of the communications of the network traffic; generate the segmentation policy based on the respective source and respective destinations of the communications; and monitor additional network traffic based on the segmentation policy. ### Claim 14 (depends on 12) The system of claim 12, wherein the customized configuration associated with the enforcement point comprises at least one of an access control list (ACL), a firewall command, or rule or a cloud packet filtering ACL. ### Claim 15 (depends on 12) The system of claim 12, wherein the processing device further to: adjust the second segmentation policy. ### Claim 16 A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to: generate a segmentation policy based on observed network traffic, the segmentation policy to restrict additional network traffic that is associated with the observed network traffic, access the segmentation policy; associate a tag with an entity, the tag being determined at least based on behavior and a classification of the entity; determine, using the processing device, a segmentation rule based on the segmentation policy and based on the tag that is associated with the entity which is managed by the segmentation rule; determine an enforcement point associated with the segmentation rule, wherein the enforcement point is communicatively coupled to a network; translate the segmentation rule into a customized configuration associated with the enforcement point, wherein the customized configuration is based on a type of the enforcement point; communicate the customized configuration to the enforcement point; access configuration information from a second enforcement point that is different from the enforcement point; translate the configuration information of the second enforcement point into a portion of a second segmentation policy; and store the portion of the second segmentation policy. ### Claim 17 (depends on 16) The non-transitory computer readable medium of claim 16, wherein to generate the segmentation policy comprises to: store network traffic, wherein the network traffic comprises a plurality of communications between a plurality of devices; determine respective source and respective destinations of the communications of the network traffic; generate the segmentation policy based on the respective source and respective destinations of the communications; and monitor additional network traffic based on the segmentation policy. ### Claim 18 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the customized configuration associated with the enforcement point comprises at least one of an access control list (ACL), a firewall command, or rule or a cloud packet filtering ACL. ### Claim 19 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the instructions further cause the processing device to: adjust the second segmentation policy.