Network agent for reporting to a network policy system

1. A network entity comprising:

a processor; and

a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the processor to perform operations including:

registering with a network policy system;

receiving a network policy configuration message including network entity independent network policies;

converting the network entity independent network policies into network entity specific network policies;

implementing, by an agent enforcer with a privileged status running on the network entity, the network entity specific network policies on the network entity;

accessing, by the agent enforcer, policy enforcement data associated with the implementation of the network policies on the network entity, access to the policy enforcement data is based on the privileged status of the agent enforcer;

transmitting, by the agent enforcer via an interprocess communication, the policy enforcement data to an agent controller running on the network entity, the agent controller having an unprivileged status;

generating, by the agent controller, a report including the policy enforcement data; and

transmitting, by the agent controller, the report to the network policy system.

2. The network entity of claim 1 , further comprising:

one or more sensors configured to collect the policy enforcement data, the access to the policy enforcement data is via an Application Programming Interface associated with the one or more sensors.

3. The network entity of claim 1 , wherein the policy enforcement data includes a number of times each network policy is enforced.

4. The network entity of claim 1 , wherein the instructions cause the processor to perform further operations including:

accessing, by the agent enforcer, performance data associated with operation of the network entity, access to the performance data based on the privileged status of the agent enforcer;

transmitting, via the interprocess communication, the performance data to the agent controller; and

wherein the report includes the performance data.

5. The network entity of claim 4 , wherein the performance data includes at least one of central processing unit (CPU) usage or memory usage.

6. The network entity of claim 1 , wherein the instructions cause the processor to perform further operations including:

accessing, by the agent enforcer, entity data associated with the network entity, access to the entity data based on the privileged status of the agent enforcer;

transmitting, via the interprocess communication, the entity data to the agent controller; and

wherein the report includes the entity data.

7. The network entity of claim 6 , wherein the entity data includes at least one of an agent identifier, an operating system, or entity interface information.

8. The network entity of claim 1 , wherein the instructions cause the processor to perform further operations including:

receiving, by the agent controller, an updated network entity independent network policy from the network policy system;

transmitting, via the interprocess communication, the updated network entity independent network policy to the agent enforcer; and

generating, by the agent enforcer, updated network policies based on the updated network entity independent network policy, wherein the updated network policies are network entity specific.

9. The network entity of claim 1 , wherein the instructions cause the processor to perform further operations including:

collecting the policy enforcement data in a cache, and

periodically transmitting the policy enforcement data to the agent controller for reporting to the network policy system.

10. A computer-implemented method comprising:

registering, by a network entity, with a network policy system;

receiving a network policy configuration message including network entity independent network policies;

converting the network entity independent network policies into network entity specific network policies;

implementing, by an agent enforcer with a privileged status running on the network entity, the network entity specific network policies on the network entity;

accessing, by the agent enforcer, policy enforcement data associated with the implementation of the network policies on the network entity;

transmitting, by the agent enforcer via an interprocess communication, the policy enforcement data to an agent controller running on the network entity, the agent controller having an unprivileged status;

generating, by the agent controller, a report including the policy enforcement data; and

transmitting, by the agent controller, the report to the network policy system.

11. The computer-implemented method of claim 10 , wherein access to the policy enforcement data is based on the privileged status of the agent enforcer.

12. The computer-implemented method of claim 10 , wherein accessing the policy enforcement data comprises communicating with one or more sensors configured to collect the policy enforcement data via an Application Programming Interface associated with the one or more sensors.

13. The computer-implemented method of claim 10 , wherein the policy enforcement data includes a number of times each network policy is enforced.

14. The computer-implemented method of claim 10 , further comprising:

accessing, by the agent enforcer, performance data associated with operation of the network entity, access to the performance data based on the privileged status of the agent enforcer; and

transmitting, via the interprocess communication, the performance data to the agent controller,

wherein the report includes the performance data.

15. The computer-implemented method of claim 10 , further comprising:

accessing, by the agent enforcer, entity data associated with the network entity, access to the entity data based on the privileged status of the agent enforcer; and

transmitting, via the interprocess communication, the entity data to the agent controller,

wherein the report includes the entity data.

16. The computer-implemented method of claim 10 , further comprising:

receiving, by the agent controller, an updated network entity independent network policy from the network policy system;

transmitting, via the interprocess communication, the updated network entity independent network policy to the agent enforcer; and

generating, by the agent enforcer, updated network policies based on the network entity independent network policy, wherein the updated network policies are network entity specific.

17. A non-transitory computer-readable medium comprising instructions, the instructions, when executed by a network entity, cause the network entity to:

register with a network policy system;

receive a network policy configuration message including network entity independent network policies;

convert the network entity independent network policies into network entity specific network policies;

implement, by an agent enforcer with a privileged status running on the network entity, the network entity specific network policies on the network entity;

access, by the agent enforcer, performance data associated with operation of the network entityon which the network policies are implemented, access to the performance data based on the privileged status of the agent enforcer;

transmit, by the agent enforcer via an interprocess communication, the performance data to an agent controller running on the network entity, the agent controller having an unprivileged status;

generate, by the agent controller, a report including the performance data; and

transmit, by the agent controller, the report to the network policy system.

18. The non-transitory computer-readable medium of claim 17 , wherein the instructions further cause the network entity to:

access, by the agent enforcer, policy enforcement data associated with implementation of the network policies on the network entity, access to the policy enforcement data based on the privileged status of the agent enforcer;

transmit, via the interprocess communication, the policy enforcement data to the agent controller; and

wherein the report includes the policy enforcement data.

19. The non-transitory computer-readable medium of claim 17 , wherein the instructions further cause the network entity to:

receive, by the agent controller, an updated network entity independent network policy from the network policy system; transmit, via the interprocess communication, the updated network entity independent network policy to the agent enforcer; and

generate, by the agent enforcer, updated network policies based on the updated network entity independent network policy, wherein the updated network policies are network entity specific.