Distribution of stateless security functions

Systems and methods are provided for receiving, at a network device, a first set of rules from a security controller of an enterprise network, the first set of rules being different from a second set of rules provided by the security controller to a firewall; implementing, at the network device, a first set of rules received from the security controller; generating, at the network device, a first log including metadata based on the first set of rules, the first log generated on a per-stream basis; notifying, at the network device, the NetFlow of a first log comprising metadata of the first set of rules; and providing the first log from the network device to a cloud log store through NetFlow of the network device, the cloud log store receiving the first log from the network device and the second log from the firewall. 提供了系统和方法，用于在网络设备处从企业网络的安全性控制器接收第一组规则，该第一组规则不同于由安全性控制器提供给防火墙的第二组规则；在网络设备处实现从安全性控制器接收的第一组规则；在网络设备处基于第一组规则生成包括元数据的第一日志，该第一日志是在每个流的基础上生成的；在网络设备处向NetFlow通知第一组规则的包括元数据的第一日志；和通过网络设备的NetFlow将第一日志从网络设备提供给