InlineClassicRecommendationSession1
{
"display_name": "Classic Recommendation Example",
"recommendation_type": "CLASSIC",
"action": "ANALYZE",
"context_vms": [
{
"id": "c29fe908-00d5-48b7-95fb-2fca418a105f",
"site_ids": [
"9e0865d0-9d89-44c7-8cc0-9f96a9b35721"
]
}
],
"segmentation_strategies": [
{
"strategy": "ALLOW_INGRESS",
"logging": false
}
],
"connectivity_preference_logging_enabled": false,
"site_ids": [
"9e0865d0-9d89-44c7-8cc0-9f96a9b35721"
],
"description": "Recommendation created by API",
"connectivity_preference": "NONE",
"group_type": "OBJECT_BASED",
"policy_type": "L4",
"monitoring_enabled": false,
"start_time": 1767315257000,
"exclude_multicast_flows": true,
"exclude_broadcast_flows": true,
"consider_source_any_rules_as_default": false,
"consider_destination_any_rules_as_default": false,
"consider_service_any_rules_as_default": false,
"additional_rules": [],
"use_private_ip_range_group": false,
"separate_rules_by_services": false
}The VM's provided by user that will be used to generate recommendations. One of context_* input properties should be filled
[Deprecated] The Physical Servers provided by user that will be used to generate recommendations.
The Groups provided by user that will be used to generate recommendations.
The Security policies provided by user that will be used to generate recommendations. if context_groups are also specified, then, the context_groups should be equal to the applied-to members of the security policies.
Defines a list of granular segmentation strategies to be applied. This allows for a more customized security policy for the application, offering finer control than the general permissive_mode.
Each strategy in the array specifies a rule for a particular traffic direction (like intra-application, ingress, or egress). The combination of these strategies dictates the final recommended security posture.
This field indicates the default connectivity policy for the application ALLOW_LIST - Adds a default drop rule DENY_LIST - Adds a default allow rule NONE - No default rules are added. This is the default setting
Enables logging to be turned on for the default rule added by connectivity strategy
If set to true, non-default rules where source is ANY will be considered as default rules. Flows hitting these rules will be considered as unmicrosegmented. In section re-use, these rules will not be picked for modification.
If set to true, non-default rules where destination is ANY will be considered as default rules. Flows hitting these rules will be considered as unmicrosegmented. In section re-use, these rules will not be picked for modification.
If set to true, non-default rules where service is ANY will be considered as default rules. Flows hitting these rules will be considered as unmicrosegmented. In section re-use, these rules will not be picked for modification.
This list contains up to 25 additional rules, which are considered as additional default rules. Flows that hit default rules and these rules will be considered as unmicrosegmented. In section re-use, these rules will not be be picked for modification.
One example of a fully qualified path is: "/infra/domains/default/security-policies/east-west-security-policy/rules/ssh-protection-rule"
An example request object would be: "additional_rules": [ { "rule_path": "/infra/domains/default/security-policies/default-layer3-section/rules/default_rule_NDP", "site_id": "7937597f-9bbc-4ca3-9921-0bc68cce6f65" }, { "rule_path": "/infra/domains/default/security-policies/Test-Policy/rules/Test-Rule", "site_id": "7937597f-9bbc-4ca3-9921-0bc68cce6f65" } ]
Port filter specifying filter type and a list of port filters
If enabled, multicast flows will not be considered in the analysis
If enabled, broadcast flows will not be considered in the analysis
If OBJECT_BASED then groups will consist of VM members otherwise it will consist of IPAddresses.
If L7 policy type is selected and L7 context data is available for analysis, then, L7 rules will be recommended otherwise L4 rules will be recommended
This integer is the N-th power of 2, which is used to set the upper bound on the number of IPv4 IPs a group can cover for it to be eligible for re-use. Valid values are integers between 4 and 32 (inclusive), or -1 to disable IPv4 group reuse entirely (no existing groups will be reused for IPv4 members). All groups that can cover more IPv4 IPs than 2^N will not be considered for re-use. e.g. With the default value 7, any group with more than 2^7=128 IPv4 IPs will not be re-used.
This integer is the N-th power of 2, which is used to set the upper bound on the number of IPv6 IPs a group can cover for it to be eligible for re-use. Valid values are integers between 4 and 128 (inclusive), or -1 to disable IPv6 group reuse entirely (no existing groups will be reused for IPv6 members). All groups that can cover more IPv6 IPs than 2^N will not be considered for re-use. e.g. With the default value 7, any group with more than 2^7=128 IPv6 IPs will not be re-used.
When enabled, recommendation will use the global shared private IP range group to cover VMs and IPs seen in the leaked flows on the non-context side, if no existing applications or tiers or groups can cover them. New groups will not be created. This can reduce the number of groups but may result in broader policy scope.
When enabled, each service gets its own separate rule even if they share the same source and destination. This creates more granular rules but increases the total number of rules. When disabled (default), rules with the same endpoints are combined into single rules with multiple services.