Policy Group Templates are an optional way to simplify policy configuration in the Elisity Cloud Control Center when the same match criteria are reused across multiple Policy Groups. Administrators define the shared match criteria once in a template, attach the template to the Policy Groups that use those criteria, and then add any criteria specific to each Policy Group. A Policy Group does not require a template.
Key Benefits
- Consistency: Keeps shared match criteria identical across every Policy Group that uses the template.
- Simplified Configuration: Defines common match criteria once instead of re-entering them in each Policy Group.
- Centralized Updates: Changes to a template apply to every linked Policy Group.
- Flexibility: Lets each Policy Group add its own match criteria on top of the template criteria.
Use Cases
Shared Match Criteria Across Policy Groups
Organizations often have sets of Global or Local Policy Groups that share common match criteria, such as different Policy Groups for various types of PCs, printers, or IoT devices. A template holds the shared criteria, and each Policy Group adds the criteria that make it distinct. All related Policy Groups keep the same baseline criteria without administrators re-entering those criteria in each Policy Group.
Multi-Site Enterprises
Organizations with multiple locations often have a Policy Group for the same type of device at each site. A template holds the device criteria that every site shares, and each site's Policy Group adds its own location-specific criteria, such as a subnet. When the shared criteria change, updating the template updates every linked Policy Group.
Onboarding New Sites and Acquisitions
When an organization adds new locations, such as through an acquisition, administrators create Policy Groups for the new sites. Attaching an existing template to each new Policy Group reuses the shared match criteria, so administrators define only the criteria specific to the new site. The new Policy Groups use the same shared criteria as the Policy Groups at existing sites.
Creating and Using Policy Group Templates
Step 1: Navigate to Policy > Policy Groups. Select the Policy Group Templates tab and click Create Template.
Step 2: Define match criteria, such as device category, vendor, or trust attributes. You can optionally assign a Security Level to the Policy Group template. Save the template for use in Policy Groups. The template page does not show a Matched Assets count. The count appears on the Matching Criteria Configuration step of each Policy Group that uses the template.
The Policy Groups column on the Policy Group Templates tab lists the Policy Groups that use each template. When more names exist than fit in the column, a + N link appears. Click the link to open the Policy Groups drawer, which lists every Policy Group that uses the template and includes a search box. Click View Details on a row to open that Policy Group in a new browser tab.
Applying a Template to a Policy Group
Step 1: When creating a Dynamic Policy Group, complete the Policy Group Configuration step and click Next. On the Policy Group Template (Optional) step, click Add Template.
Step 2: In the Add Template dialog, choose an existing template from the Policy Group Template list to inherit its predefined match criteria, and continue to the Matching Criteria Configuration step.
Step 3: On the Matching Criteria Configuration step, a read-only card at the top shows the template and its match criteria. Below the card, define any additional match criteria specific to the Policy Group. The Matched Assets counts include the template criteria.
When a template is attached, the Policy Group's own criteria are optional. To define the Policy Group by the template alone, leave its criteria empty, or click the delete (trash bin) icon to clear the last criteria row.
Step 4: On the Summary step, review the template card with its criteria and any additional match criteria. When the Policy Group has no criteria of its own, the Summary shows No additional Matching Criteria. Save the Policy Group with the inherited template attributes.
Managing Templates and Updates
- Any changes to a template automatically apply to linked Policy Groups.
- If a template is deleted, users receive warnings about the impact on linked Policy Groups.
- Policy Groups can only inherit criteria from one template at a time.
- Two Policy Groups cannot be defined by the same template alone. Add at least one criterion that distinguishes one of them; otherwise, the Matching Criteria Configuration step shows an error.
- Templates apply to top-level Policy Groups only. A nested Policy Group inherits template criteria through its parent and cannot carry a template of its own. For more information, see Nested Policy Groups.
Best Practices
- Regularly review and update templates to align with evolving security needs.
- Use templates for match criteria that several Policy Groups share, and keep criteria that apply to a single Policy Group in that Policy Group.
- Monitor linked Policy Groups for any necessary adjustments after template modifications.
Conclusion
Policy Group Templates are optional. When several Policy Groups share the same match criteria, a template keeps those criteria in one place, so administrators define them once and update them in one place.