METHOD, PRODUCT, AND SYSTEM FOR GENERATING DETECTION SIGNATURES BASED ON ATTACK PATHS IN A COMPUTER NETWORK IDENTIFIED USING A SOFTWARE REPRESENTATION THAT EMBODIES NETWORK CONFIGURATION AND POLICY DATA FOR SECURITY MANAGEMENT USING DETECTION SIGNATURE TEMPLATES

Disclosed is an approach for generating detection signatures based on analysis of a software representation of what is possible in a computer network based on network configuration data and network policy data. In some embodiments, the process includes maintaining a plurality of detection signature templates, generation of detection signatures (detection signature instances) using respective detection signature templates that are selected based on the analysis of the software representation. In some embodiments, detection signatures templates are of different type and may be deployed at different locations based on their respective type(s), such as at source, destination.