Consistent monitoring and analytics for security insights for network and security functions for a security service

1. A system comprising:

a processor configured to:

receive a flow at a software-defined wide area network (SD-WAN) device;

inspect the flow to determine whether the flow is associated with a split tunnel;

monitor the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service, comprising to:

collect flow data with security context using the SD-WAN device, wherein the flow data includes the following: an ingress IP address, an egress IP address, an ingress port number, an egress port number, a protocol, and session data usage and time related statistics; and

communicate the collected security information associated with the flow to the security service after a session associated with the flow is ended, comprising to:

send, using the SD-WAN device, the flow data with the security context to the security service, wherein the security service is a cloud-based security service; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the flow is associated with a whitelist policy and is allowed to bypass the security service based on a security policy.

3. The system recited in claim 1 , wherein the flow is associated with the split tunnel and is allowed to bypass the security service based on a security policy.

4. The system recited in claim 2 , wherein the processor is further configured to:

periodically communicate the collected security information associated with the flow to the security service.

5. The system recited in claim 1 , wherein the security service is the cloud-based security service that is provided using a public cloud service provider.

6. The system recited in claim 1 , wherein the security service is the cloud-based security service that is provided using a plurality of public cloud service providers.

7. The system recited in claim 1 , wherein another flow is a site to site tunnel that bypasses the security service, and wherein the SD-WAN device collects security information associated with the another flow for reporting to the security service.

8. A method, comprising:

receiving a flow at a software-defined wide area network (SD-WAN) device;

inspecting the flow to determine whether the flow is associated with a split tunnel;

monitoring the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service, comprising to:

collecting flow data with security context using the SD-WAN device, wherein the flow data includes the following: an ingress IP address, an egress IP address, an ingress port number, an egress port number, a protocol, and session data usage and time related statistics; and

communicating the collected security information associated with the flow to the security service after a session associated with the flow is ended, comprising:

sending, using the SD-WAN device, the flow data with security context to the security service, wherein the security service is a cloud-based security service.

9. The method of claim 8 , wherein the flow is associated with a whitelist policy and is allowed to bypass the security service based on a security policy.

10. The method of claim 8 , wherein the flow is associated with the split tunnel and is allowed to bypass the security service based on a security policy.

11. The method of claim 8 , further comprising:

periodically communicating the collected security information associated with the flow to the security service.

12. The method of claim 8 , wherein the security service is the cloud-based security service that is provided using a plurality of public cloud service providers.

13. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving a flow at a software-defined wide area network (SD-WAN) device;

inspecting the flow to determine whether the flow is associated with a split tunnel;

monitoring the flow at the SD-WAN device to collect security information associated with the flow for reporting to a security service, comprising to:

collecting flow data with security context using the SD-WAN device, wherein the flow data includes the following: an ingress IP address, an egress IP address, an ingress port number, an egress port number, a protocol, and session data usage and time related statistics; and

communicating the collected security information associated with the flow to the security service after a session associated with the flow is ended, comprising:

sending, using the SD-WAN device, the flow data with security context to the security service, wherein the security service is a cloud-based security service.

14. The computer program product recited in claim 13 , wherein the flow is associated with a whitelist policy and is allowed to bypass the security service based on a security policy.

15. The computer program product recited in claim 13 , wherein the flow is associated with the split tunnel and is allowed to bypass the security service based on a security policy.

16. The computer program product recited in claim 13 , further comprising computer instructions for:

periodically communicating the collected security information associated with the flow to the security service.

17. The computer program product recited in claim 13 , wherein the security service is the cloud-based security service that is provided using a plurality of public cloud service providers.

18. The computer program product recited in claim 13 , wherein another flow is a site to site tunnel that bypasses the security service, and wherein the SD-WAN device collects security information associated with the another flow for reporting to the security service.