Skip to main content
Security Essentials policies attach curated network threat lists to managed sites. Each list includes operational metadata such as prefix count, BGP community, update interval, and last updated time so you can understand what the policy is doing before you attach it.

​
Prerequisites

  • You understand which sites should use the policy.
  • You can test critical applications after attaching a new policy.
  • You have a rollback plan for high-sensitivity environments.

​
How It Works

Security Essentials policies are made from one or more list categories. SDX keeps the lists updated, and the policy determines which sites receive that protection. List metadata helps you review operational impact.
Treat DoH and DoT related categories carefully. Blocking public encrypted DNS providers can strengthen DNS enforcement, but it can also affect clients that rely on those resolvers.

​
Attach a Policy

  1. Open Policies and select Security Essentials.
  2. Create or edit a policy.
  3. Select the list categories that match your risk posture.
  4. Review prefix count and update metadata for each selected list.
  5. Attach the policy to a small set of representative sites first.
  6. Test critical traffic paths.
  7. Roll out to the remaining sites after validation.

​
Advanced Rollout Pattern

For production fleets, use a staged rollout.
  1. Attach the policy to a low-risk pilot site.
  2. Monitor connectivity, support tickets, and Fault Logging.
  3. Expand to a tagged group of similar sites.
  4. Keep a stricter policy for higher-risk networks and a conservative policy for sensitive business locations.

​
Troubleshooting

If a destination stops working after policy attachment, compare the timing of the failure with the policy change, test from a site without the policy, and review whether the destination belongs to a selected list category. If the policy is too broad for that environment, detach it or move the site to a narrower policy.
Security Essentials reduces exposure to known-risk networks. Use DNS Content Filtering for web category control and Security Groups for explicit firewall intent.