Intelligent firewall policy processor

A method comprising:

• obtaining telemetry data, the telemetry data being associated with a plurality of applications running on a plurality of hosts;
• based on the telemetry data, determining of subset of applications of the plurality of applications that run on a first host of the plurality of hosts;
• determining a subset of firewall policies of a plurality of firewall polices, each of the subset of firewall policies applying to at least one respective application of the subset of applications;
• generating an indication of the subset of firewall policies;
• and
• sending the indication to a management plane of a distributed firewall.

Non-transitory computer-readable storage media storing instructions, which, when executed, cause processing circuitry to:

• obtain telemetry data, the telemetry data being associated with a plurality of applications running on a plurality of hosts;
• based on the telemetry data, determine of subset of applications of the plurality of applications that run on a first host of the plurality of hosts;
• determine a subset of firewall policies of a plurality of firewall polices, each of the subset of firewall policies applying to at least one respective application of the subset of applications;
• generate an indication of the subset of firewall policies;
• and
• send the indication to a management plane of a distributed firewall.