Event Trigger Policies

Navigate to Identities :: Groups

Create a Quarantine IP Group

We will temporarily place users who violate our DPI and Connection Event Triggers into a Transient IP Group.  We will assign the Quarantine Group to the Triggers, and while in this group, users will not have internet access and will be directed to the Splash Portal associated with the Customer Onboarding Policy.

Click Create New in the Link Controls scaffold.

Navigate to Policies :: Event Triggers

Create a new Connections Trigger

Click Create New in the Connections Triggers scaffold.

Create a new Quota Trigger

Click Create New in the Connections Triggers scaffold.

Create a new Remote DPI Signature

Click Create New in the Remote DPI Signature scaffold.  Accept the defaults, which will pull from emergingthreats.net

Edit the Emerging Threats Remote DPI Signature

Click Edit on the Emerging Threats Remote DPI Signature record.  Review the list of categories and select several categories by command or control clicking items in the box.

Create a new DPI Trigger

Click Create New in the DPI Triggers scaffold.

Review Policy Dashboard

Click Policies in the top menu. The Policy Dashboard now illustrates our policy enforcement configuration. 

Navigate to Identities :: Groups

Update Basic Account Group Priority

When users trigger the Premium Quota Trigger, they are temporarily placed into the Basic Account Group (a transient group membership).  Currently, the groups priority is the same as the Premium Account Group (all account groups are set to 4 by default).  We need to increase the priority of the Basic Account Group so that it takes priority over the devices other group memberships.

Click Edit on the Basic Account Group.

Increase the priority to 5

Review Final Policy Dashboard