Security Policy User Guide 21.5

The scope of a ruleset determines which workloads receive the ruleset's rules and enables the rules in a ruleset to apply to workloads in a group (one scope).

When workloads share the same set of labels defined in a ruleset's scope, those workloads receive all the rules from the ruleset. When you add a second scope, all the workloads within both scopes receive the rules from the ruleset.

A single scope is defined by using three labels that identify the workload:

For example, a scope (or collection of workloads that the rules are applied to) is defined as ERP | Prod | US, which means that the rules apply to any workload that meets the following three requirements:

That example is relatively simple, but combining rules and scopes can be used to create complex security policies.

Using multiple scopes in a ruleset applies the rules to each scope in isolation and does not allow workload cross-communication.

When the same type of label is used multiple times in a rule, they are expanded as multiple rules with one label for each rule.

The following examples further demonstrate how scopes work with rules.

You can view the ruleset status on the Ruleset page. The current status of each ruleset (enabled or disabled) is displayed in the Status column. When you change a ruleset but haven't provisioned the change yet, the type of change (addition, deletion, or modification) appears in the Provision Status column with the word “Pending” to indicate that these changes must be provisioned to be applied.

You can filter the rulesets list using the label and property filter at the top of the list. You can filter the list by entering a label type to show only those rulesets that use the selected labels. You can further filter the list by selecting specific properties of the rulesets. For example, you can filter the list by provision status, such as rulesets that are in draft state and have not yet been provisioned.

You can create a ruleset to write rules that define the allowed communication between workloads in a single group or multiple groups. See Groups in Illumination in the Visualization Guide for information.

When you write a rule for a Windows workload, you can add a Windows service name without specifying a port or protocol and the rule will allow communication for that service over any port and protocol.

The following task creates a single scope, which means the rules in the ruleset apply to a single group. To apply the rules to another group, add a second scope, which is indicated by the group's Application, Environment, and Location labels.

To create a ruleset:

Now that the ruleset is created, you can add rules to define your security policy. See Rules for information about the types of rules you can add.

You can create rulesets with multiple scopes to define the allowed communication between workloads in one or more groups. See Groups in Illumination in the Visualization Guide for information.

How you define the scope in a ruleset enables you to write rules for workloads in multiple groups (two or more scopes). Each scope corresponds to one group. The scope defines the boundaries of the rules in the ruleset.

To create a multi-scope ruleset:

The green Addition Pending icon that this addition is pending, so you need to provision the new ruleset in order for the rule to take effect. See Provisioning for more information.

When you have a ruleset that you want to use to create other new rulesets, you can duplicate an existing ruleset.

After saving the new duplicate ruleset, make any needed scope or rule changes and then provision to apply them. See Provisioning for more information.