Create policies to protect your computers and other resources

Policies allow collections of rules and configuration settings to be saved for easier assignment to multiple computers. You can use the Policy editorClosedTo open the Policy editor, go to the Policies page and double-click the policy that you want to edit (or select the policy and click Details). to create and edit policies that you can then apply to one or more computers. You can also use the Computer editorClosedTo open the Computer editor, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). (which is very similar to the Policy editor) to apply settings to a specific computer, but the recommended method is to create specialized policies rather then edit the settings in the Computer editor.

You can automate policy creation and configuration using the Deep Security API. For examples, see the Create and Configure Policies guide in the Deep Security Automation Center.

In this article:

Create a new policy

  1. Click Policies > New > New Policy.
  2. Enter a name for the policy. If you want the new policy to inherit its settings from an existing policy, select a policy from the Inherit from list. Click Next.

    For information on inheritance, see Policies, inheritance, and overrides.

  3. Select whether you want to base this policy on an existing computer's configuration and then click Next.
  4. If you selected Yes in step 3:
    1. Select a computer to use as the basis for the new policy and click Next.
    2. Specify which protection modules will be enabled for the new policy. If this policy is inheriting its settings from an existing policy, those settings will be reflected here. Click Next.
    3. On the next screen, select the properties that you want to carry into the new policy and click Next. Review the configuration and click Finish.
  5. If you selected No in step 3, specify which protection modules will be enabled for the new policy. If this policy is inheriting its settings from an existing policy, those settings will be reflected here. Click Finish.
  6. Click Close. Next, you can edit the settings for the policy, as described in Edit the settings for a policy or individual computer.

Other ways to create a policy

There are several ways to create a policies on the Policies page:

  • Create a new policy as described above.
  • Click New > Import From File to import policies from an XML file.
  • When importing policies, ensure that the system where you created the policies and the system that will receive them both have the latest security updates. If the system that is receiving the policies is running an older security update, it may not have some of the rules referenced in the policies from the up-to-date system.
  • Duplicate (and then modify and rename) an existing policy. To do so, right-click an existing policy you want to duplicate and then click Duplicate.
  • Create a new policy based on a recommendation scan of a computer. To do so, go to the Computers page, right-click a computer and select Actions > Scan for Recommendations. When the scan is complete, return to the Policies page and click New to display the New Policy wizard. When prompted, choose to base the new policy on "an existing computer's current configuration". Then select "Recommended Application Types and Intrusion Prevention Rules", "Recommended Integrity Monitoring Rules", and "Recommended Log Inspection Rules" from among the computer's properties.
  • The Policy will consist only of recommended elements on the computer, regardless of what Rules are currently assigned to that computer.

Edit the settings for a policy or individual computer

The Policies page shows your existing policies in their hierarchical tree structure. To edit the settings for a policy, select it and click Details to open the policy editor.

These sections are available in the Computer or Policy editorClosedYou can change these settings for a policy or for a specific computer. To change the settings for a policy, go to the Polices page and double-click the policy that you want to edit (or select the policy and click Details). To change the settings for a computer, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details).:

Assign a policy to a computer

  1. Go to Computers.
  2. Select your computer from the Computers list, right click and choose Actions > Assign Policy.
  3. Select the policy from the hierarchy tree and click OK.

One of the following occurs:

  • If you set the communication direction to Manager Initiated or Bidirectional, the policy is sent immediately to the agent computer.
  • If you set the communication direction to Agent/Appliance Initiated, then the policy is sent when the next agent heartbeat occurs.

For more information on how child policies in a hierarchy tree can inherit or override the settings and rules of parent policies, see Policies, inheritance, and overrides.

After assigning a policy to a computer, you should still run periodic recommendation scans on your computer to make sure that all vulnerabilities on the computer are protected. See Manage and run recommendation scans for more information.

Disable automatic policy updates

By default, any changes to a security policy are automatically sent to the computers that use the policy. You can change this so automatic sending is disabled, and you must manually send the policy.

  1. Open the Policy editorClosedTo open the Policy editor, go to the Policies page and double-click the policy that you want to edit (or select the policy and click Details). for the policy to configure.
  2. Go to Settings > General > Send Policy Changes Immediately.
  3. Next to Automatically send Policy changes to computers, select Yes to allow automatic sending of policy changes. To disable automatic sending, and only allow manually sending, select No.
  4. Click Save to apply the changes.

Send policy changes manually

If you make a policy change and want to send the policy changes manually to a particular computer, follow the instructions below.

  1. Go to Computers .
  2. Double-click your computer from the Computers list.
  3. In the navigation pane, make sure Overview is selected.
  4. In the main pane, click the Actions tab.
  5. Under Policy, click Send Policy.

One of the following occurs:

  • If you set the communication direction to Manager Initiated or Bidirectional, the policy is sent immediately to the agent computer.
  • If you set the communication direction to Agent/Appliance Initiated, then the policy is sent when the next agent heartbeat occurs.

Export a policy

To export a policy to an XML file, select a policy from the policies tree and click Export > Export Selected to XML (For Import).

When you export a selected policy to XML, any child policies that the policy may have are included in the exported package. The export package contains all the actual objects associated with the policy except: intrusion prevention rules, log inspection rules, integrity monitoring rules, and application types.