Discover Policies Automatically

Automatic policy discovery, sometimes referred to as policy discovery, and formerly known as Application Dependency Mapping (ADM), uses existing traffic flows and other data to do the following:

• Suggest a set of “allow” policies based on existing successful network activity.

  The goal of these policies is to identify the traffic that your organization needs, and block all other traffic.

• Group workloads into clusters based on similarity of their computing behavior

  For example, if an application includes multiple web servers, those might be clustered together.

  For more information, see Clusters.

You can discover policies for each scope. Typically, you discover policies for scopes at or near the bottom of your scope tree, for example at the application level. However, for initial deployment, you might want to discover policies at a higher-level scope, so you have general, temporary policies in place while you create more refined policies.

You can discover policies as often as desired, to refine the suggested policies based on additional information.

You can manually modify suggested policies and clusters, and/or approve any of them so they are carried forward and not modified by subsequent discovery runs.

You can include both manually created policies and discovered policies in a workspace.

After you discover policies, you will review and analyze them before enforcing them.

To get started discovering policies, see How to Automatically Discover Policies.

For more information, see Policy Discovery Details.