COLLECTING AND PROCESSING CONTEXT ATTRIBUTES ON A HOST

An architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some examples, containers in other examples, or a mix of VMs and containers in still other examples. Some examples execute a guest-introspection (Gl) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines on each host computer, these examples also execute a context engine and one or more attribute-based service engines on each host computer. Through the Gl agents of the machines on a host, the context engine of that host in some examples collects contextual attributes associated with network events and/or process events on the machines. The context engine then provides the contextual attributes to the service engines, which, in turn, use these contextual attributes to identify service rules for processing.