|
Enforcement
|
|
Enforcement
|
Enable - Enable policy enforcement on the agent. After you enable enforcement, the agent enforces the most recently received policy set. Disable (Default) - The agent does not enforce a policy.
|
If you enable, disable and re-enable policy enforcement on the agent, it clears the firewall state and sets the catch-all default action to ALLOW.
|
|
|
Windows Enforcement Mode
|
On Windows workloads, agents can enforce network policies using:
|
|
Preserve Rules
|
Enable - Preserves existing firewall rules on the agent.
Disable (Default) - Clears existing firewall rules before applying enforcement policy rules from Secure Workload.
Behaviour of the Preserve Rules attribute is platform-specific. You can view the details of the attributes in the Preserve Rules section in each platform.
|
|
Allow Broadcast
|
Enable (Default) - Adds rules to the firewall to allow ingress and egress broadcast traffic on workload.
Disable - Does not add any rules. The broadcast traffic drops if the default policy on the agent is DENY.
|
|
Allow Multicast
|
Enable (Default) - Adds rules to the firewall to allow ingress and egress multicast traffic on workload.
Disable - Does not add any rules. The Multicast traffic drops if the default policy on the agent is DENY.
|
|
Allow Link Local Addresses
|
Enable (Default) - Adds rules to the firewall to allow link local addresses traffic on workload.
Disable - Does not add any rules. The Multicast traffic drops if the default policy on the agent is DENY.
|
|
CPU Quota Mode
|
Adjusted (Default) - The CPU limit adjusts according to the number of CPUs on the system. For example, if there are 10 CPUs, set the CPU limit to 3%, the agents use only a total of 30% (measured by top).
Top - The CPU limit value matches the top view on average. For example, if you set the CPU limit to 3% and there are 10 CPUs in the system, the CPU usage is 3%. It is a fairly restrictive mode, use it only when necessary.
Disable - Disable the CPU limit feature. The agent uses CPU resources that used in the operating system.
For more information, see Secure Workload Data Sheet.
|
|
CPU Quota Limit (%)
|
Specify the actual limit in percentage of the system processing power.
|
|
Memory Quota Limit (MB)
|
Specify the memory limit (in MB) for processes. If the process hits this limit, it restarts.
|
|
Flow Visibility
|
|
Flow Analysis Fidelity
|
Conversations (Default) - Enable conversation mode on all agents.
Detailed - Enable detailed mode on all agents.
|
|
Deep Packet Inspection
|
Enable (Default) - Enable the agent to obtain information about TLS, SSH, proxy connections, and domain names from the payload of a few specific network packets.
Disable - Disable the agent from collecting the above information. |
|
Data Plane
|
Enable (Default) - Enable the agent to send reports to the cluster.
Disable - Disable the agent’s reports.
|
|
Auto-Upgrade
|
Enable (Default) - Automatically upgrade the agent when a new package is available.
Disable - Do not automatically upgrade the agent.
|
|
PID/User Lookup
|
Enable - Process ID (PID) and User Lookup in agents.
Set the Flow Analysis Fidelity option to detailed mode for PID and User Lookup. When you enable this feature, the agent associates network flows with running processes and users in the workload. During the process, note that some flows that might not be associated with any process even after you enable the configuration.
Disable (Default) - Do not enable process ID and User Lookup in agents.
|
User Lookup is not supported on Windows Server 2008 R2.
|
|
|
Service Protection
|
Enable - When enabled, the agent ensures it prevents server admin users from disabling the windows agent service, restarting the Windows agent service or uninstalling the Windows agent. However, after disabling Service Protection, you can continue to stop or restart agent services, and uninstall the agent.
To temporarily disable the Service Protection from the hosts, see Generate Agent Token section.
|
Enabling Service Protection does not affect Secure Workload Admin initiated actions including:
-
Manual upgrade of an agent (triggered from the UI on the page) will still work even if Service Protection is enabled.
-
Auto upgrade of an agent (triggered from the agent config profile) will still work even if Service Protection is enabled.
-
Secure Workload Admins can still delete agents from the UI even if Service Protection is enabled. This operation does not delete the agents from the hosts themselves.
However, installer scripts initiated actions such as agent upgrade/uninstall/reinstall will be blocked since those are triggered by server admin users.
|
Disable(Default)-The Service Protection is disabled by default on the agent.
|
This feature is available only for Windows agent.
|
|
|
CPU Quota Mode
|
Adjusted (Default) - Adjust the CPU limit according to the number of CPUs on the system. For example, if there are 10 CPUs in the system, set the CPU limit to 3%.
Choose this mode to allow the agent to use a total of 30% (measured by top).
Top- The CPU limit value matches the top view on average. For example, set the CPU limit to 3% for the 10 CPUs in the system, the CPU usage is only 3%. It is a fairly restrictive mode and uses it only when necessary.
Disable - Disable the CPU limit feature. The agent uses CPU resources that are used in the operating system.
|
|
CPU Quota Limit (%)
|
Specify the actual limit in percentage of the system processing power that the agent can use.
|
|
Memory Quota Limit (MB)
|
Specify the memory limit in MB that the process allows to use. If the process hits this limit, the process restarts.
|
|
Cleanup period (days)
|
Enable - Enable automated cleanup on the agent. Enter the number of days after which remove the inactive agent.
Disable (Default) - Do not enable automated cleanup on the agent.
|
|
Flows Disk Quota (MB)
|
Enter the maximum size limit (in MB) for storing the flow data.
If the Flows Disk Quota field is:
-
0: The agents do not store offline flows locally.
-
Blank: Enable the Flows Time Window field. After you enter the duration in the Flows Time Window, the Flows Disk Quota field automatically sets the value to16 GB.
You can either choose the Flows Disk Quota or the Flows Time Window option for flow log buffering in case of connectivity break between the agent and the cluster.
For example, if you have set the Flows Time Window as one hour and the agent is unable to communicate with the cluster, the agent stores flow data for the last hour. Any flow data locally stored on the workload beyond the last hour is overridden by newer logs.
Specify in MB the total size limit of stored flow data.
|
|
Flows Time Window (Hours)
|
Specify in hours how long the agent must capture and store flows locally.
Choose either Flows Disk Quota or Flows Time Window; it's either size-based or time-based rotation. On choosing Flows Time Window, set the Flows Disk Quota to 16 GB. Setting Flows Disk Quota to 0 disables this feature.
The flow data is rotated when it reaches either size limit or time limit.
This field is displayed only when there is no value that is entered in the Flows Disk Quota field.
Enter the duration, in hours, for the agents to capture the flows and store them locally.
-
After the connectivity to the agents is restored, the agents send the live flow data.
-
While sending the live flow data, the agents also initiates to upload the buffered telemetry data. The telemetry data is sent in small packets at regular intervals.
-
Depending on the size of the buffered telemetry data and transmission transfer speed, it takes multiple intervals to send all the buffered data.
-
The agents progressively deletes the locally stored flow data.
Remove the outdated flow data that is stored locally after it reaches the configured size or time limit.
|
|
Flow Rules
|
Flow rules optimizes network telemetry by reducing the volume of data reported to the cluster. It address issues like running out of flow traffic retention space or dealing with unnecessary policy generation due to certain types of traffic.
|
By default, this option is hidden if no flow rules are present.
|
Enter the following field details for the flow rules.
-
IP Family: Select either IPv4 or IPv6.
-
Source CIDR: Enter the destination address in CIDR notation.
-
Source Ports: Enter comma-separated source port number or 'any'.
-
Destination CIDR: Enter the destination address in CIDR notation.
-
Destination Ports: Enter comma-separated source port number or 'any'.
-
Protocol: Select a protocol from TCP, UDP, or ICMP.
-
Action
-
Manage: Click the add button to create more flow rules.
|
|
Package Visibility, Process Visibility and Forensics
|
|
Package Visibility
|
Enable ̶ Enable collecting and reporting of the installed software packages found on the workload. This is required for discovering and presenting the vulnerabilities (CVEs) attached to this workload.
Disable (Default) - Disable Package Visibility on the agent.
|
|
Process Visibility
|
Enable ̶ Enable the tracking of long running processes. This is required for discovering and presenting the list of Long Lived Processes on the workload with their CPU and memory consumption trend and process file hash. Additionally, to construct the Process Snapshot graph and to allow linking the process with the package and therefore presenting if a process is associated to a CVEs on the Process Snapshot graph.
Disable (Default) ̶ Disable Process Visibility.
|
|
Forensics
|
Enable ̶ Enables forensics on the agent. Agent will listen to and acquire a rich set of real-time events from the operating system. This is necessary for detecting if any event of a programmed forensic rule has been detected. This also allows the agent to detect and report short-lived processes. This in turn leads to a richer and more comprehensive Process Snapshot graph, and to be able to populate the process command line in more captured network flows.
|
|
Meltdown Exploit Detection
|
Enable ̶ Enable Forensics and Meltdown exploit detection on the agent. For more information, see Side Channel in the Compatibility.
Disable (Default) ̶ Disable Meltdown exploit detection on the agent.
|
|
CPU Quota Mode
|
Adjusted (Default) ̶ Adjust the CPU limit according to the number of CPUs on the system. For example, set the CPU limit to 3% with 10 CPUs in the system. Choose this mode to use a total of 30% (measured by top).
Top ̶ The CPU limit value matches the top view on average. For example, set the CPU limit to 3% with 10 CPUs in the system, the CPU usage remains at 3%. Use this restrictive mode only if necessary.
Disable ̶ Disable the CPU limit feature, the agent uses CPU resources permissible by the operating system.
|
|
CPU Quota Limit (%)
|
Specify the actual limit, in percentage, of the system processing power the agent can use.
|
|
Memory Quota Limit (MB)
|
Specify the memory limit (in MB). If the storage limit goes beyond the specified limit, the process restarts.
|
