Views:
Policies allow collections of rules and configuration settings to be saved for easier assignment to multiple computers. You can use the Policy editor to create and edit policies that you can then apply to one or more computers. You can also use the Computer editor (which is very similar to the Policy editor) to apply settings to a specific computer, but the recommended method is to create specialized policies rather then edit the settings in the Computer editor.
Tip
Tip
You can automate policy creation and configuration using the Server & Workload Protection API. For examples, see Create and Configure Policies.

Create a new policy Parent topic

Procedure

  1. Click Policies → New → New Policy.
  2. Enter a name for the policy. If you want the new policy to inherit its settings from an existing policy, select a policy from the Inherit from list and click Next.
    Tip
    Tip
    For information on inheritance, see Policies, inheritance, and overrides.
  3. Select whether you want to base this policy on an existing computer's configuration and then click Next.
  4. If you selected Yes in step 3:
    1. Select a computer to use as the basis for the new policy and click Next.
    2. Specify which protection modules will be enabled for the new policy. If this policy is inheriting its settings from an existing policy, those settings will be reflected here. Click Next.
    3. On the next screen, select the properties that you want to carry into the new policy and click Next. Review the configuration and click Finish.
  5. If you selected No in step 3, specify which protection modules will be enabled for the new policy. If this policy is inheriting its settings from an existing policy, those settings will be reflected here. Click Finish.
  6. Click Close. Next, you can edit the settings for the policy, as described in Edit the settings for a policy or individual computer.

Other ways to create a policy Parent topic

You can create a new policy as described above. Alternatively, you can follow the instructions in the following sections to create a policy.

Import policies from an XML file Parent topic

Note
Note
You can download a default XML file to use in a policy: Policy XML for Windows Desktop Policy XML for macOS
To import a policy from an XML file:

Procedure

  1. Click New → Import From File.
    Note
    Note
    When importing policies, ensure that the system where you created the policies and the system that will receive them both have the latest security updates. If the system that is receiving the policies is running an older security update, it may not have some of the rules referenced in the policies from the up-to-date system. The import policy might update some default scan configurations or rules using the suggested default setting. Please check the import wizard for policy update information.
  2. Click Choose File and select the XML file.
  3. From the Import under drop-down, select:
    • Base Policy if using macOS.
    • Windows if using Windows desktop.
  4. Click Next.
  5. Close the wizard.

What to do next

Your new policy will match the settings from the XML file you selected.

Duplicate an existing policy Parent topic

To duplicate an existing policy:
From the Policies tab, right-click the existing policy that you want to duplicate and select Duplicate.
A duplicate of the policy will appear on the list.

Create a new policy based on the recommendation scan of a computer Parent topic

To create a new policy based on the recommendation scan of a computer:

Procedure

  1. From the Computers tab, right-click a computer and select Actions → Scan for Recommendations.
  2. When the scan is complete, return to the Policies tab and click New to open the New Policy wizard.
  3. When prompted, choose to base the new policy on "an existing computer's current configuration".
  4. Select "Recommended Application Types and Intrusion Prevention Rules", "Recommended Integrity Monitoring Rules", and "Recommended Log Inspection Rules" from among the computer's properties.

What to do next

Note
Note
A new policy is created consisting only of recommended elements on the computer, regardless of which rules are currently assigned to that computer.

Edit the settings for a policy or individual computer Parent topic

The Policies page shows your existing policies in their hierarchical tree structure. To edit the settings for a policy, select it and click Details to open the policy editor.
These sections are available in the Computer or Policy editor:

Assign a policy to a computer Parent topic

Procedure

  1. Go to Computers.
  2. Select your computer from the Computers list, right click and choose Actions → Assign Policy.
  3. Select the policy from the hierarchy tree and click OK.

What to do next

The policy is sent when the next agent heartbeat occurs.
For more information on how child policies in a hierarchy tree can inherit or override the settings and rules of parent policies, see Policies, inheritance, and overrides.
After assigning a policy to a computer, you should still run periodic recommendation scans on your computer to make sure that all vulnerabilities on the computer are protected. See Manage and run recommendation scans for more information.

Disable automatic policy updates Parent topic

By default, any changes to a security policy are automatically sent to the computers that use the policy. You can change this so automatic sending is disabled, and you must manually send the policy.

Procedure

  1. Open the Policy editor for the policy to configure.
  2. Go to Settings → General → Send Policy Changes Immediately.
  3. Next to Automatically send Policy changes to computers, select Yes to allow automatic sending of policy changes. To disable automatic sending, and only allow manually sending, select No.
  4. Click Save to apply the changes.

What to do next

Send policy changes manually Parent topic

If you make a policy change and want to send the policy changes manually to a particular computer, follow the instructions below.

Procedure

  1. Go to Computers.
  2. Double-click your computer from the Computers list.
  3. In the navigation pane, make sure Overview is selected.
  4. In the main pane, click the Actions tab.
  5. Under Policy, click Send Policy.

What to do next

The policy is sent when the next agent heartbeat occurs.

Export a policy Parent topic

To export a policy to an XML file, select a policy from the policies tree and click Export → Export Selected to XML (For Import).
Note
Note
When you export a selected policy to XML, any child policies that the policy may have are included in the exported package. The export package contains all the actual objects associated with the policy except: intrusion prevention rules, log inspection rules, integrity monitoring rules, and application types.