Conditional policies

1. A method comprising:

detecting, via a computer having a processor configured to execute computer readable instructions, a change to a security measurement of an endpoint in a network from a first value to a second value, the security measurement of the endpoint represented by a number on a scale, a decimal number from 0-1, a binary result, or multiple values describing different security parameters;

determining, via the computer, one or more policies that are applicable to the endpoint based on the security measurement corresponding to the second value; and

updating, via the computer, policy data for the network to enforce the one or more policies with respect to the endpoint.

2. The method of claim 1 , wherein updating the policy data includes:

updating an endpoint group of the endpoint from a first endpoint group to a second endpoint group,

wherein the one or more policies are applicable to the second endpoint group and not applicable to the first endpoint group.

3. The method of claim 1 , wherein updating the policy data includes:

determining one or more first policies in a policy table that are applicable to the endpoint based on the security measurement corresponding to the first value; and

adding the one or more policies to the policy table,

wherein the one or more policies are prioritized over the one or more first policies based on the one or more policies corresponding to a level of specificity exceeding that of the one or more first policies.

4. The method of claim 1 , wherein updating the policy data includes:

determining one or more first policies in a policy table that are applicable to the endpoint based on the security measurement corresponding to the first value; adding the one or more policies to the policy table of the network; and removing the one or more first policies from the policy table.

5. The method of claim 1 , further comprising:

remediating the endpoint based on network traffic flow between the endpoint and a second endpoint, wherein the one or more policies include a policy that allows the network traffic flow.

6. The method of claim 5 , further comprising:

detecting a second change to the security measurement of the endpoint from the second value to the first value or a third value;

determining one or more second policies that are applicable to the endpoint based on the security measurement corresponding to the first value or the third value; and

updating policy data of the network to enforce the one or more second policies with respect to the endpoint.

7. The method of claim 1 , wherein the one or more policies are whitelist rules, and updating the policy data includes:

determining one or more second policies that are applicable to the endpoint based on the security measurement corresponding to the first value;

removing the one or more second policies from a policy table; and

adding the one or more policies to the policy table to allow a network traffic flow between the endpoint and a second endpoint.

8. The method of claim 1 , wherein the one or more policies are blacklist rules, and updating the policy data includes:

determining one or more second policies that are applicable to the endpoint based on the security measurement corresponding to the first value;

adding the one or more second policies to a policy table; and

removing the one or more policies to deny a network traffic flow between the endpoint and a second endpoint.

9. The method of claim 1 , further comprising:

receiving a packet including a source or a destination corresponding to the endpoint;

determining a network action for the packet based on the one or more policies; and

performing the network action,

wherein the network action is one of forwarding the packet, dropping the packet, logging the packet, marking the packet, selecting a service graph for the packet, redirecting the packet, or copying the packet.

10. The method of claim 1 , wherein the policy data includes a policy table applicable to a first collection of endpoints of the network and not applicable to a second collection of endpoints of the network.

11. The method of claim 1 , wherein the policy data includes a policy table applicable to an entirety of the network.

12. A non-transitory computer-readable medium having computer readable instructions that, when executed by a processor of a computer, cause the computer to:

define a conditional policy for an endpoint in a network, the conditional policy corresponding to at least a first policy for the endpoint having a first value for a security measurement and a second policy for the endpoint having a second value for the security measurement, the security measurement represented by a number on a scale, a decimal number from 0-1, a binary result, or multiple values describing different security parameters;

determine that the security measurement of the endpoint corresponds to the first value;

add the first policy to a policy table of the network; and

enforce the first policy.

13. The non-transitory computer-readable medium of claim 12 , wherein the computer readable instructions further cause the computer to:

update an endpoint group of the endpoint from a first endpoint group to a second endpoint group,

wherein the first policy is applicable to the second endpoint group and not applicable to the first endpoint group.

14. The non-transitory computer-readable medium of claim 12 , wherein,

the policy table includes the second policy, and

the first policy is enforced instead of the second policy based on the first policy corresponding to a level of specificity exceeding that of the second policy.

15. The non-transitory computer-readable medium of claim 12 , wherein the computer readable instructions further cause the computer to:

remove the second policy from the policy table.

16. The non-transitory computer-readable medium of claim 12 , wherein the computer readable instructions further cause the computer to:

modify a state of the endpoint based on network traffic flow between the endpoint and a remediation server,

wherein the first policy allows the network traffic flow between the endpoint and the remediation server.

17. The non-transitory computer-readable medium of claim 16 , wherein the computer readable instructions further cause the computer to:

detect a change to the security measurement of the endpoint from the first value to the second value;

obtain the second policy based on the security measurement corresponding to the first value; and

update the policy table to enforce the second policy with respect to the endpoint.

18. A system comprising:

a processor; and

a memory including instructions that when executed by the processor, cause the system to:

define a policy for an endpoint group in a network corresponding to a first value range for a first security measurement;

detect a second security measurement corresponding to an endpoint not associated with the endpoint group;

determine that the second security measurement is within the first value range; and

assign the endpoint to the endpoint group,

wherein,

the first security measurement and/or the second security measurement is represented by a number on a scale, a decimal number from 0-1, a binary result, or multiple values describing different security parameters.

19. The system of claim 18 , wherein the policy is a whitelist rule, and the instructions further cause the system to:

determine one or more second policies that are applicable to the endpoint based on the first security measurement corresponding to a third value, wherein the one or more second policies are configured to block a network traffic flow between the endpoint and a second endpoint; and

allow, based on at least the policy, the network traffic flow.

20. The system of claim 18 , wherein the policy is a blacklist rule, and the instructions further cause the system to:

determine one or more second policies that are applicable to the endpoint based on the security measurement corresponding to a third value, wherein the one or more second policies are configured to allow a network traffic flow between the endpoint and a second endpoint; and

block, based on at least the policy, the network traffic flow.