Create and Edit Policies

An asset policy is the configuration forwarders receive: which file types to collect, which paths to skip, and how the forwarder behaves on the host. Policies are scoped to a single environment and are applied to assets through a group. Every environment has a Default Policy that all of its assets get; a policy you create is applied on top of that for the assets in the group it is attached to.

Create the policy before you create the group that will use it, because the policy is selected during group creation.

How do I create a policy?

1. Log in to app.stairwell.com.
2. Open Settings from the left menu.
3. Under Environments, open Asset policies.
4. Select the environment this policy belongs to, using the environment filter at the top of the list.
5. Click Create policy.
6. Enter a name. Make it say who it is for, because the name is what you will be reading in a group's policy dropdown a year from now. Linux build servers is a name; Policy 3 is not. Default Policy is reserved and cannot be reused.
7. Configure the three tabs, described below.
8. Click Save.
9. Click All policies to return to the list.

A new policy does nothing until a group carries it. See Manage Groups.

How do I edit a policy?

1. Open Settings, then Asset policies under Environments.
2. Select the environment containing the policy.
3. Click the ... icon under Actions and select Edit.
4. Change what you need across the three tabs.
5. Click Save.

Some policies are marked read-only. On those, the edit controls and the Save button are disabled rather than hidden, so a policy you cannot change looks the same as one you can until you try.

An edit takes effect on the assets in the attached groups on their next policy fetch, not instantly. If you have changed a scan schedule or a resource limit and want to confirm it landed, check the asset rather than the policy.

What is on the Extensions tab?

The list of file types the forwarder collects, in three categories.

Together the two default categories are roughly 65 formats, all enabled. Turning one off is recorded as disabled rather than removed, so the decision stays visible and reversible.

Two things to keep in mind when adding a format:

• An extension exclusion beats the extension list. An exclusion whose glob matches the file wins even if the extension is enabled here. If you have added a format and it is not arriving, check the exclusions attached to this policy first.
• Extension lists union across groups. An asset in two groups collects every format either policy enables, so adding a format to a cohort policy does not require touching the default policy.

What is on the Forwarder settings tab?

Four sections. Each one is described in full, with its defaults and ranges, in Asset Configuration; this is the map.

Two of these carry a caution worth repeating here, because they change what Stairwell sees rather than only how hard the host works:

• Only-backscan mode turns off real-time collection. A file written, executed, and deleted between two backscans is never seen. If you use it, pair it with generous resource limits and a wide enough window that the scan completes.
• The Windows kernel driver setting can disable the driver. Without it the forwarder still sees process executions and library loads, but not file creations, modifications, deletions, or renames. That is a substantial reduction in visibility, and a daily backscan is the usual partial mitigation.

Remember that these merge across groups with the tightest value winning, and that only-backscan mode wins over real-time if any of an asset's policies sets it. See Groups and Policies.

What is on the Exclusions tab?

The environment-level exclusions attached to this policy.

To attach one, click Add exclusion, select from the environment's exclusions, and save. To create a new exclusion you have to go to Asset exclusions under Environments; the policy tab attaches existing exclusions rather than defining new ones.

Exclusions are the setting on a policy that reduces visibility, so Exclusions covers what each type costs and why the per-OS field on an exclusion silently disables it if it does not match the asset. In short: put exclusions on a cohort policy, not on the default policy, and prefer the narrowest path that solves the problem.

Policy field reference

What should I read next?

• Asset Configuration, for every forwarder setting with its default, range, and the forwarder versions that support it.
• Manage Groups, for attaching the policy to the machines it is for.
• Exclusions, before you add one.