The traffic behind it
Which flows, from which hosts, over what period, and how many times — not a confidence score with nothing under it.
Decide
Policy you don't
have to write.
Segmenta reads what your fleet actually does and proposes the least-privilege rules that would cover it — each one with the evidence behind it. You accept, adjust, or decline.
Suggested rulecovers 18% of this app
FromWeb tier4 hosts
ToDatabaseSRV-SQL-01
- Port
- tcp/1433
- Seen
- 3,596,077 flows · 21 days
- Process
- w3wp.exe → sqlservr.exe
- Narrowed to
- role → role, one port
AcceptAdjustDecline
The hard part, done
From two million flows to a handful of decisions.
Segmentation projects don't stall on the firewall. They stall on turning hundreds of thousands of observed connections into rules a human is willing to sign off. That is the part Segmenta automates.
01
Observe
Every flow on every managed host, attributed to the process and the container that opened it.
02
Group
Hosts and containers are grouped into the roles they play, so a rule describes a job rather than an address.
03
Narrow
Each candidate rule is narrowed to the tightest form the evidence supports — a role, a named network, a single port.
04
Propose
What survives is a small set of decisions, each carrying the flows that justify it and the reason it stopped where it did.
Intent, not addresses
You say which roles may talk.
A rule names a role on each side — "the web tier may reach the database on 1433" — and Segmenta compiles it into concrete firewall rules on every host that plays those roles. Add a server to the role and it inherits the policy; retire it and the rules go with it.
- Roles are reusable across the fleet, per application
- Rules survive an address change, a rebuild, or a new container
- No hand-written per-host rulesets to drift out of date
Suggested rule
evidence: 3,596,077 flows
Web tier
→
Database
protocol / porttcp/1433
observed from4 hosts, 21 days
owning processw3wp.exe
narrowed torole → role, single port
Accept, adjust the scope, or decline
covers 18% of this app
Show your working
Every suggestion carries its evidence.
A recommender you can't interrogate is a recommender you won't trust with your firewall. Each decision shows what it saw, what it ruled out, and why it stopped where it did.
How far it narrowed
Whether it landed on a role, a named network or an address, and what evidence stopped it going tighter.
What it held back
Flows deliberately excluded — scanner noise, probe traffic, candidate-gathering chatter — are disclosed, never silently dropped.
What it would cover
How much of the application's observed traffic this one rule accounts for, so you can see the shape of the remaining work.
Questions
About the suggestions.
What the engine will and won't do on your behalf.
Does it apply rules automatically?
No. Every suggestion waits for a human. There is no auto-apply, because a recommender that writes your firewall without asking is a recommender that will eventually take production down.
What if the traffic it learned from was malicious?
That is why the evidence is on every row. Segmenta proposes rules from what it saw; deciding whether what it saw should have been happening is the operator's job, and the console is built to make that judgement quick rather than to remove it.
Will it suggest a rule for something that only happened once?
It is deliberately reluctant to. Breadth across hosts and consistency over time weigh on every suggestion, and thin evidence is labelled rather than hidden. A single failed burst, a scan or a sweep is held back and disclosed rather than turned into policy.
Can I write rules by hand as well?
Yes. Suggestions are a starting point, not a cage — you can author rules directly at any scope, and hand-written and suggested rules compile through exactly the same path.
What happens when my network changes?
Rules describe roles, so a new host joining a role inherits the policy and a retired one takes its rules with it. New traffic that nothing covers surfaces as a new decision rather than silently being allowed.
Let the traffic write the first draft.
Thirty days, with the policy suggested for you.