Cisco
Login
Search
Software Secure Workload
Activity Configure

Manage Inventory for Secure Workload Filters Create a Domain Filter

Last updated: Jun 09, 2025

Create a Domain Filter

Use a domain filter to group domains and identify flows where a consumer or provider domain name matches the filter that is defined in your environment.

In conversation mode, only certain types of proxies are supported for domain enforcement, such as HTTP proxy and TCP. In case of TCP, when a domain is blocked with intent, the first packet may pass through; however, the connection is blocked even before a handshake is complete.

Rules for Domain Filters

  • A valid domain name must include at least one second-level domain. For example, *.cisco.com or even *.com are acceptable formats when com being the first-level domain. You can include any number of domain names within the filter.

  • Each label in the domain name can have only letters, numbers, or a hyphen.

  • Use the wildcard * in the domain name and only for the first label, for example, *.amazon.com, but do not use aws.*.com. Also, do not combine wildcards with any other characters using regex, for example, do not use aws*.com.

  • A wildcard matches any number of labels (subdomains), for example, *.yahoo.com matches finance.yahoo.com, web.finance.yahoo.com and all its subdomains. However, it does not match yahoo.com.

  • www prefix is treated as a subdomain, and is therefore not treated as the domain itself, for example, google.com and www.google.com are separate domains.

  • Domain filter queries cannot be restricted to a scope. Also, domain filter will not yield any matching inventories.

Procedure

1

Navigate to one of these locations:

  • Choose Organize > Inventory Filters.

  • Navigate to a workspace in the scope to create an inventory filter, click Manage Policies > Filters > Inventory Filters.
2

Click Create Filter or Add Inventory Filter to display the Inventory Filter page.
3

Check the Domain Filter check box.
4

Enter a name and query for the domain filter, and click Next

5

Review the details and click Create to create a domain filter.
For every new inventory filter, create a corresponding new object type that defines the kind of objects for filter matches. The possible values are:

  • INVENTORY encompasses workloads, services, pods, and IP addresses.

  • DOMAIN refers to domains. Domain name is the only facet available to match domains; all other facets match only the INVENTORY type.

You can create a heterogenous filter using the domain name and another facet with an OR operator, for example domain name=*.google.com OR hostname that contains mach. However, it is not possible to use AND to combine such facets using the AND operator, for example domain name=*.google.com AND hostname that contains mach.

Previous topic Review Filter Change Impact Next topic Restrict to Ownership Scope