Performing process control services on endpoint machines

1. A method of performing services on heterogeneous endpoint machines in a datacenter, the method comprising:

on a first endpoint machine of a first type and executing on a first host computer, installing a first guest introspection (GI) agent and a first service engine; on a second endpoint machine of a different, second type and executing on a second host computer, installing a second guest introspection (GI) agent; configuring the first GI agent to capture and store a first set of contextual data items associated with a first new launched process on the first endpoint machine, said first set of contextual data items for the first service engine on the first endpoint machine to use to perform a process-control service on the first new launched process; and

configuring the first service engine to register with a set of one or more notification services on the first endpoint machine to receive notifications regarding new launched processes for at least one application executing on the first endpoint machine, wherein the first service engine performs the process-control service on launched processes identified in response to receiving a notification, by using stored contextual data items associated with the identified launched processes; and configuring the second GI agent to capture a second set of contextual data items associated with a second new launched process on the second endpoint machine and to provide the second set of contextual data items to be stored outside of the second endpoint machine on the second host computer, in order for a second service engine, which executes on the second host computer separately from the second endpoint machine, to use to perform a process-control service on the second new launched process.

2. The method of claim 1 , wherein the first GI agent notifies the first service engine of the first launched process.

3. The method of claim 2 , wherein the first GI agent provides at least one captured contextual data item to the first service engine along with the notification of the first launched process.

4. The method of claim 2 , wherein each service engine retrieves from a storage at least one contextual data item that the corresponding GI agent stored in the storage for the new launched process.

5. The method of claim 1 , wherein the process-control service is a service that determines whether a process should be allowed, terminated, have its operations replicated, be designated for malware inspection, or have the data messages that it sends or receives be subject to deep packet inspection.

6. The method of claim 1 , wherein each service engine performs the process-control service based on a set of service rules each of which comprises a rule identifier and a service action, the rule identifiers of at least a subset of service rules defined by reference to at least one contextual data item.

7. The method of claim 1 , wherein the first endpoint machine is a bare metal machine, and the second endpoint machine is a virtual machine executing on top of a hypervisor that executes on the second host computer.

8. The method of claim 1 , wherein the first endpoint machine is a container, and the second endpoint machine is a virtual machine executing on top of a hypervisor that executes on the second host computer.

9. The method of claim 1 , wherein the endpoint machines are virtual machines.

10. A non-transitory machine readable medium comprising sets of instructions for execution by at least one hardware processing unit of a computer to perform services on heterogeneous endpoint machines in a datacenter, the sets of instructions for: on a first endpoint machine of a first type and executing on a first host computer, installing a first guest introspection (GI) agent and a first service engine; on a second endpoint machine of a different, second type and executing on a second host computer, installing a second guest introspection (GI) agent; configuring the first GI agent to capture and store a first set of contextual data items associated with a first process event associated with a first process on the first endpoint machine, said first set of contextual data items for the first service engine on the first endpoint machine to use to perform a process-control service on the first process; and

configuring the first service engine to register with a set of one or more notification services on the first endpoint machine to receive notifications regarding new launched processes for at least one application executing on the first endpoint machine, wherein the first service engine performs the process-control service on launched processes identified in response to receiving a notification, by using stored contextual data items associated with the identified launched processes; and configuring the second GI agent to capture a second set of contextual data items associated with a second process event associated with a second process on the second endpoint machine and to provide the second set of contextual data items to be stored outside of the second endpoint machine on the second host computer, in order for a second service engine, which executes on the second host computer separately from the second endpoint machine, to use to perform a process control service on the second process.

11. The non-transitory machine readable medium of claim 10 , wherein the first GI agent notifies the first service engine of the first process event.

12. The non-transitory machine readable medium of claim 11 , wherein the first GI agent provides at least one captured contextual data item to the first service engine along with the notification of the first process event.

13. The non-transitory machine readable medium of claim 11 , wherein each service engine retrieves from a storage at least one contextual data item that the corresponding GI agent stored in the storage for the process event.

14. The non-transitory machine readable medium of claim 10 , wherein the contextual data items include data other than layer 2, layer 3 and layer 4 header values of the data messages.

15. The non-transitory machine readable medium of claim 10 , wherein the contextual data items include layer 7 data tuples.

16. The non-transitory machine readable medium of claim 10 , wherein the contextual data items include at least one of a process identifier and a user group identifier.

17. The non-transitory machine readable medium of claim 10 , wherein the first endpoint machine comprises one of a bare metal machine, a container, and a virtual machine, and the second endpoint machine is a virtual machine executing on top of a hypervisor that executes on the second host computer.

18. A method of performing services on heterogeneous endpoint machines in a datac enter, the method comprising: on a first endpoint machine of a first type and executing on a first host computer, installing a first guest introspection (GI) agent and a first service engine; on a second endpoint machine of a different, second type and executing on a second host computer, installing a second guest introspection (GI) agent; configuring the first GI agent to capture and store a first set of contextual data items associated with a first new launched process on the first endpoint machine, said first set of contextual data items for the first service engine on the first endpoint machine to use to perform a process-control service on the first new launched process; configuring registering each GI agent to register with a set of one or more notification services on the corresponding endpoint machine to receive notifications regarding new process launch events for at least one application executing on the corresponding endpoint machine, wherein each GI agent captures and stores contextual data associated with a new launched process in response to receiving a notification from the notification service on the corresponding endpoint machine regarding the new launched process; configuring the second GI agent to capture a second set of contextual data items associated with a second new launched process on the second endpoint machine and to provide the second set of contextual data items to be stored outside of the second endpoint machine on the second host computer, in order for a second service engine, which executes on the second host computer separately from the second endpoint machine, to use to perform a process-control service on the second new launched process.