Before You Begin

Before you begin to configure NSX with Policy Enforcer, configure the infected hosts workflow in VMWare vCenter Server.

Infected Hosts Workflow in VMware vCenter Server

Procedure

1. Log in to the vSphere Web Client through the VMware vCenter Server.
2. From the vSphere Web Client, click Networking & Security and then click NSX Managers.

   Under the Manage section, click Security Tags column head and create SDSN_BLOCK security tag for NSX, as shown in Figure 110.

   Figure 110: SDSN_BLOCK Security Tag

   

   The feed for the infected hosts will be triggered by Sky ATP down to Policy Enforcer. When there is a trigger, the SDSN_BLOCK tag is attached to the VM. Click on the VM Count column to see the VM details attached to the tag.

3. Select Networking & Security and then click Service Composer.

   The Service Composer page appears. From the Service Composer, click the Security Groups tab. The security administrator can create the security group based on the security tag.

4. Click the New Security Group icon to create a new security group.
5. Enter a name and description for the security group and then click Next.
6. On the Define dynamic membership page, define the criteria that an object must meet for it to be added to the security group you are creating.

   In the Criteria Details row, select Security Tag from the list and provide the SDSN_BLOCK tag name, as shown in Figure 111.

   Figure 111: Define Dynamic Membership Page

   

   Click Next.

7. In the Ready to Complete page, verify the parameters and click Finish.

   In the Service Composer page, under the Security Groups tab, you can see that the security group has been created and the VM with the security tag is assigned to the security group.