Explicit Entities Learning

1. “Add All Entities” / “Always”

• Description:

  • This option creates a comprehensive whitelist policy by adding all explicit entities that match a wildcard.

  • Results in a strict and granular configuration.

  • Suitable for environments requiring maximum security.

• Automatic Learning Mode:

  • Automatically adds all explicit entities matching a wildcard.

  • Once the policy stabilizes, the wildcard (*) is removed to enforce stricter entity control.

• Manual Learning Mode:

  • Suggests explicit entities matching the wildcard for manual review and addition.

  • Does not remove the wildcard.

• Use Case:

  • Best for organizations prioritizing high security over ease of management.

  • Works well for applications with predictable and well-defined entities.

---

2. “Never (Wildcard Only)”

• Description:

  • The policy relies solely on the wildcard entity (*), resulting in a simpler policy with less granularity.

  • Easy to manage but less strict in terms of security.

• Automatic Learning Mode:

  • Does not add explicit entities matching the wildcard.

  • Modifies the attributes of the wildcard entity to reflect new learning.

  • The wildcard is not removed.

• Manual Learning Mode:

  • Does not suggest adding explicit entities matching the wildcard.

  • Suggests modifying attributes of the wildcard entity.

  • The wildcard remains in place.

• Use Case:

  • Suitable for simpler environments with low risk or when minimal configuration is required.

  • Balances simplicity with basic protection.

---

3. “Selective”

• Description:

  • A balanced approach between strictness, policy size, and maintenance.

  • Adds explicit entities only when false positives occur with the wildcard entity.

• Automatic Learning Mode:

  • Adds explicit entities that do not match the wildcard’s attributes.

  • Does not remove the wildcard.

• Manual Learning Mode:

  • Suggests adding explicit entities that match the wildcard for manual review.

  • Retains the wildcard in the policy.

• Use Case:

  • Ideal for environments where false positives need addressing without overcomplicating the policy.

  • Offers a middle ground between security and ease of maintenance.

---

4. “Compact”

• Description:

  • A compact approach that leverages scoring thresholds to determine whether new entities should be added to the policy.

  • Ensures the policy remains efficient and avoids bloating.

• Settings:

  • add_entity_min_score: Threshold for adding new entities (default = 100%).

  • cleanup_entity_min_score: Threshold for removing unused entities (default = 10%).

  • cleanup_entity_min_seconds: Time threshold for removing unused entities (default = 24 hours).

  • To disable automatic cleanup: set cleanup_entity_min_seconds = -1.

• Automatic Learning Mode:

  • Adds explicit entities matching the wildcard if their learning score meets the add_entity_min_score threshold.

  • The wildcard remains.

• Manual Learning Mode:

  • Suggests adding explicit entities based on their learning score.

  • Does not remove the wildcard.

• Use Case:

  • Best for environments prioritizing policy efficiency and size control.

  • Suitable for applications where traffic patterns are dynamic and change frequently.

---

Comparison Table

Option	Granularity	Ease of Management	Strictness	Use Case
Add All Entities	High	Low	High	Maximum security, predictable entities.
Never (Wildcard)	Low	High	Low	Simplified policy, basic protection.
Selective	Medium	Medium	Medium	Balance between security, size, and maintenance.
Compact	Low	High	Medium	Efficient policy management with minimal bloat.

---

Key Considerations

• Policy Size: More explicit entities increase the size and complexity of the policy but improve precision.

• Wildcard Usage: Retaining the wildcard simplifies management but sacrifices strictness.

• False Positives: Choose "Selective" or "Compact" to address false positives effectively.

• Scoring: "Compact" adds automation and efficiency using learning score thresholds.