Re-running Automatic Policy Discovery

You can rerun automatic policy discovery at any time. The main reasons to rerun automatic policy discovery are to include additional information that was not included in the previous run, or to exclude information that is not helpful. For example, you can:

• Install additional agents or configure additional connectors, and allow some flow data to accumulate.

• Increase the timespan used for discovery, to include more data.

• Approve clusters (with or without editing them first), which can improve the clustering of other workloads upon rerun. See Approving Clusters.

• Exclude flows that you know you don't want to influence policy so you don't have to edit them out. See Policy Discovery Flow Filters.

• Change advanced settings (for details, see Advanced Configurations for Automatic Policy Discovery.)

• Capture changes after you have made changes to Address Policy Complexities.

Automatically discovering policies again on an existing workspace may generate different clusters and policies in the workspace.

If a host is no longer in the scope of the workspace, upon a subsequent automatic policy discovery run, that host will not appear in any cluster; if it were in an approved cluster, it will no longer appear in that cluster. Even with the same set of member workloads but with a different timeframe or configuration, automatic policy discovery may result in different clusters.

For a list of the types of policies that are not modified during policy discovery, see Approved Policies.

Removal of Redundant Policies On subsequent automatic policy discovery, approved policies in primary workspaces will remove matching conversations for policy generation, so redundant policies are not generated. Note that, as is the case for exclusion filters, this functionality may not work perfectly on non-primary workspaces if the policy uses a Cluster filter defined in the workspace. Cluster filters from a non-primary workspaces are not active, and will not match any flows, thus redundant policies may still be generated in non-primary workspaces during automatic policy discovery.