Segmentation management including visualization, configuration, simulation, or a combination thereof

1. A method comprising:

accessing a plurality of segmentation rules;

determining one or more characteristics of a plurality of entities communicatively coupled to a network;

determining a plurality of groups based on at least one characteristic of the one or more characteristics, wherein each group comprises at least one entity of the plurality of entities;

selecting a first group and a second group from the plurality of groups;

determining a first set of one or more segmentation rules associated with the first group, wherein the first set of one or more segmentation rules is associated with a respective environment of the at least one entity of the first group;

determining a second set of one or more segmentation rules associated with the second group, wherein the second set of one or more segmentation rules is associated with a respective environment of the at least one entity of the second group;

monitoring traffic of the plurality of entities communicatively coupled to a network;

performing a simulation of the first set of one or more segmentation rules and the second set of one or more segmentation rules as applied to the plurality of entities based on the traffic of the plurality of entities;

determining communication properties between the first group and second group based on the simulation;

determining a subgroup of the first group based on at least one characteristic associated with at least one entity of the first group; and

displaying an indication of the communication properties between the first group and the second group, wherein the subgroup of the first group is displayed in a hierarchy with the first group, wherein the indication comprises a matrix illustrating the communication properties between each entity of the first group, represented as rows of the matrix, and each entity of the second group, represented as columns of the matrix, and wherein the communication properties indicate a level of communication between the corresponding entities of the first and second group associated with an intersection of the rows and columns of the matrix allowed by the plurality of segmentation rules.

2. The method of claim 1 further comprising:

storing the traffic from the network; and

displaying another indication of communication properties between the first and the second group based on the simulation of the first set of one or more segmentation rules and the second set of one or more segmentation rules.

3. The method of claim 2 , wherein the another indication is associated with a violation of a segmentation rule of the first set of one or more segmentation rules or the second set of one or more segmentation rules.

4. The method of claim 1 , wherein the at least one characteristic of the one or more characteristics of an entity is determined without use of an agent.

5. The method of claim 1 , wherein the indication comprises at least one of a green color associated with allowed communication, a yellow color associated with some allowed communication, or a red color associated with blocked communication.

6. The method of claim 1 , wherein the matrix comprises a first entity characteristic of the first group and a second entity characteristic of the second group.

7. The method of claim 1 , wherein the at least one characteristic is at least one of location, device type, compliance, risk, or network connection.

8. The method of claim 1 , wherein a subgroup based on a plurality of characteristics of at least one entity of the first group is displayed in a hierarchy with the first group.

9. The method of claim 8 , wherein the plurality of characteristics are user configurable.

10. The method of claim 1 , wherein the hierarchy is based on a plurality of tags.

11. The method of claim 6 , wherein the matrix is user configurable.

12. The method of claim 1 , wherein the indication of the communication properties between the first group and the second group is based on the simulation of at least one of the first set of one or more segmentation rules and the second set of one or more segmentation rules.

13. The method of claim 1 , wherein the plurality of entities comprises at least one of a device, an endpoint, a virtual machine, a service, a serverless service, a container, or a user.

14. A system comprising:

a memory; and

a processing device, operatively coupled to the memory, to:

access a plurality of segmentation rules;

determine one or more characteristics of a plurality of entities communicatively coupled to a network;

determine a plurality of groups based on at least one characteristic of the one or more characteristics, wherein each group comprises at least one entity of the plurality of entities;

select a first group and a second group from the plurality of groups;

determine a first set of one or more segmentation rules associated with the first group wherein the first set of one or more segmentation rules is associated with a respective environment of the at least one entity of the first group;

determine a second set of one or more segmentation rules associated with the second group wherein the second set of one or more segmentation rules is associated with a respective environment of the at least one entity of the second group;

monitor traffic of the plurality of entities communicatively coupled to a network;

perform a simulation of the first set of one or more segmentation rules and the second set of one or more segmentation rules as applied to the plurality of entities based on the traffic of the plurality of entities;

determine communication properties between the first group and second group based on the simulation;

determine a subgroup of the first group based on at least one characteristic associated with at least one entity of the first group; and

display an indication of the communication properties between the first group and the second group, wherein the subgroup of the first group is displayed in a hierarchy with the first group, wherein the indication comprises a matrix illustrating the communication properties between each entity of the first group, represented as rows of the matrix, and each entity of the second group, represented as columns of the matrix, and wherein the communication properties indicate a level of communication between the corresponding entities of the first and second group associated with an intersection of the rows and columns of the matrix allowed by the plurality of segmentation rules.

15. The system of claim 14 , wherein the processing device further to:

storing the traffic from the network; and

displaying a second indicator of blocked traffic between the first and the second group based on the stored traffic and based on the first set of one or more segmentation rules and the second set of one or more segmentation rules.

16. The system of claim 14 , wherein the matrix comprises a first entity characteristic of the first group and a second entity characteristic of the second group.

17. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:

access a plurality of segmentation rules;

determine, with the processing device, one or more characteristics of a plurality of entities communicatively coupled to a network;

determine a plurality of groups based on at least one characteristic of the one or more characteristics, wherein each group comprises at least one entity of the plurality of entities;

select a first group and a second group from the plurality of groups;

determine a first set of one or more segmentation rules associated with the first group wherein the first set of one or more segmentation rules are associated with a respective environment of the at least one entity of the first group;

determine a second set of one or more segmentation rules associated with the second group wherein the second set of one or more segmentation rules are associated with a respective environment of the at least one entity of the second group;

monitor traffic of the plurality of entities communicatively coupled to a network;

perform a simulation of the first set of one or more segmentation rules and the second set of one or more segmentation rules as applied to the plurality of entities based on the traffic of the plurality of entities;

determine communication properties between the first group and second group based on the simulation;

determine a subgroup of the first group based on at least one characteristic associated with at least one entity of the first group;

and

display an indication of the communication properties between the first group and the second group, wherein the subgroup of the first group is displayed in a hierarchy with the first group, wherein the indication comprises a matrix illustrating the communication properties between each entity of the first group, represented as rows of the matrix, and each entity of the second group, represented as columns of the matrix, and wherein the communication properties indicate a level of communication between the corresponding entities of the first and second group associated with an intersection of the rows and columns of the matrix allowed by the plurality of segmentation rules.

18. The non-transitory computer readable medium of claim 17 , wherein the matrix comprises a first entity characteristic of the first group and a second entity characteristic of the second group.