Framework for coordination between endpoint security and network security services

A method for applying security policies to virtual machines, the method comprising:

• to detect a security threat, performing a security service on a virtual machine (VM) that operates based on a first set of network connectivity settings;
• after detecting the security threat, associating a tag with the VM;
• based on the tag, assigning to the VM a second set of network connectivity settings that is more restricted than the first set of network connectivity settings;
• and
• after resolution of the security threat, removing the association of the tag with the VM and assigning the first set of network connectivity settings to the VM.

A method for applying security policies to virtual machines (VMs), the method comprising:

• receiving through a user interface data to create a first security container to associate with the VMs;
• defining the first security container and specifying a first set of network connectivity settings for the VMs associated with the first security container;
• associating the first security container with a security service that is to be performed on any VM associated with the first security container to detect a security condition on the VM;
• and
• defining a second security container to associate with any VM with the detected security condition, and specifying a reduced, second set of network connectivity settings for any VM associated with the second security container.

A non-transitory machine readable medium storing a program for applying security policies to virtual machines, the program for execution by at least one processing unit, the program comprising sets of instructions for:

• to detect a security threat, performing a security service on a virtual machine (VM) that operates based on a first set of network connectivity settings;
• after detecting the security threat, associating a tag with the VM;
• based on the tag, assigning to the VM a second set of network connectivity settings that is more restricted than the first set of network connectivity settings;
• and
• after resolution of the security threat, removing the association of the tag with the VM and assigning the first set of network connectivity settings to the VM.