A method comprising: receiving, by a policy controller for a computer network, traffic statistics for a plurality of traffic flows among a plurality of application workloads, the plurality of application workloads executed by a first set of one or more computing devices of a computer network; generating, from the traffic statistics for the plurality of traffic flows, one or more tags that correspond to tags with which the plurality of application workloads are tagged; applying the one or more tags to the traffic statistics for the plurality of traffic flows; correlating, by the policy controller, the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads based on the one or more tags specified by the traffic statistics for the plurality of traffic flows corresponding to the tags with which the plurality of application workloads are tagged; generating, by the policy controller and based on the session records of traffic statistics for the plurality of application workloads, one or more application firewall policies for the plurality of application workloads, wherein the one or more application firewall policies define whether traffic flows between application workloads of the plurality of application workloads are to be allowed or denied; and distributing, by the policy controller, the one or more application firewall policies to a second set of one or more computing devices for application to traffic flows between instances of the application workloads, wherein the second set of one or more computing devices is different from the first set of one or more computing devices. receiving, by a policy controller for a computer network, traffic statistics for a plurality of traffic flows among a plurality of application workloads, the plurality of application workloads executed by a first set of one or more computing devices of a computer network; generating, from the traffic statistics for the plurality of traffic flows, one or more tags that correspond to tags with which the plurality of application workloads are tagged; applying the one or more tags to the traffic statistics for the plurality of traffic flows; correlating, by the policy controller, the traffic statistics for the plurality of traffic flows into session records of traffic statistics for the plurality of application workloads based on the one or more tags specified by the traffic statistics for the plurality of traffic flows corresponding to the tags with which the plurality of application workloads are tagged; generating, by the policy controller and based on the session records of traffic statistics for the plurality of application workloads, one or more application firewall policies for the plurality of application workloads, wherein the one or more application firewall policies define whether traffic flows between application workloads of the plurality of application workloads are to be allowed or denied; and distributing, by the policy controller, the one or more application firewall policies to a second set of one or more computing devices for application to traffic flows between instances of the application workloads, wherein the second set of one or more computing devices is different from the first set of one or more computing devices.