Skip to main content

Security Policy Guide 25.1

Rule-Based Labeling

Rule-based labeling allows you to assign labels to one or more workloads when their attributes match the conditions you specify in easily-configurable rules. This simplifies the task of labeling multiple workloads.

Before you begin

  • Label assignment:

    • You can assign system default and user-defined labels to matching workloads.

    • You can assign only one label of a given type to a workload.

    • Beginning in release 25.21, Rule-Based Labeling can replace existing labels already assigned to workloads if the Overwrite option is selected. Otherwise, existing labels already assigned to workloads can't be overwritten. For example, if Overwrite is selected and a matching workload has an existing Location label of New York and your labeling rule specifies a Location label of London, the existing New York Location label is replaced with the London Location label. If Overwrite is not selected, the London Location label is bypassed and the New York label remains.

    • Depending on how many workloads match labeling rules, it may take a few minutes for the labels to be assigned to all of them. You can navigate to other areas of the PCE UI while the load process continues in the background. When matching and loading has finished, a notification appears wherever you are in the PCE user interface

  • Events: An event is created when a rule-based label is assigned to a workload. The name format of the event differs depending on how the label is assigned. When a label is assigned from the PCE UI, the name format is label_mapping_rules_run.assign_labels. Also, the generated_by field displays the user's email address. For system jobs, the generated_by field displays system.

  • Removal restriction: It's not possible to remove a label from the list of labels (Policy Objects > Labels) if its used in a labeling rule.

Typical Labeling Rule Workflow

Here is a typical workflow for adding rules, launching a search for matching workloads, and assigning labels.

Step 1: Add a Labeling Rule

Labeling rules work by identifying workloads in your environment that match certain conditions you specify and then assigning one or more labels to those workloads. See Work with Labeling Rules.

Step 2: Find and review matching workloads

After adding labeling rules, let the Rule Labeling feature search your environment for workloads that match the rule conditions, and then review the generated list of workloads. See Find and Review Matching Workloads.

Step 3: Assign labels to matching workloads

Once the feature finds matching workloads, you can assign the labels you specified in Step 1: Add a Labeling Rule. See Assign labels to matching workloads.