Synthetic audit events in workload segmentation

Systems and methods include operating a local security agent that is configured to allow or block flows based on security policies, to implement microsegmentation; and, responsive to a block of a flow, creating a synthetic audit event that reflects what the flow would have been had it not been blocked. The steps can include creating a packet for the flow and transmitting the packet with an indicator that it represents the synthetic audit event. The steps can include receiving the security policies which include an indicator on which blocks to create the synthetic audit event.