Skip to main content

View Policies

This topic introduces you to Lacework policies and how to view and configure policies in the Lacework Console.

View Policies​

You can view and work with policies in the Policies page in the Lacework Console. To view Lacework policies, log in to the Lacework Console and click Policies from the left navigation menu.

The page consists of a dashboard and the policy list. The dashboard presents a graphical view of the policy list, showing the number of policies enabled and disabled, policies by type, and policies by severity.

Policies dashboard

You can hide the dashboard by clicking the collapse icon at the top right.

The Lacework Console shows a subset of the policies at a time. To see and sort all policies, you can download the policy list as a comma-separated values file. The CSV-formatted file lets you view the many types and tags associated with policies.

Filter Policies​

The policy list displays up to 50 policies at a time. Use the arrows to page through the policy list or the Sort by menu to order policies by name, severity, or date of last update.

The filtering options enable you to specify criteria for which policies appear in the policies list. Filters let you select policies by domain, type, status, severity, and more.

The filtering options are dynamic. For example, if you filter domain on AWS, the policy types relevant to AWS appear in the Type filter options, such as S3, Identity and Access Management, and CloudTrail.

Policies view

The rule types include these options:

  • Default policies are built-in, Lacework provided policies.
  • Custom policies are policies that you or others in your organization have created. For information on custom policies, see Create Policies.
  • Legacy policies are policies that are obsolete or have been superseded. In general, you should move away from legacy policies over time.

Other filtering options include:

  • Status: Whether a policy is enabled or disabled
  • Severity: The severity level associated with the policy, such as critical, high, low, and so on.
  • Tags: Descriptive tags associated with policies

After selecting filtering criteria, click Reset to return the list to its default.

Save and Share a View​

At any time, you can share your current view by clicking the Copy link icon at the top right. You can send that link to others who will be able to view the same filtering selections.

After configuring filter options, you can save your view by clicking the Save view icon at the top right of the console. Access the view later through the Open view icon.

When you open a saved view, its name displays in the page title in the format Policies / view name. Click the icon adjacent to this name to access additional actions, such as duplicate or delete. Note that saved or shared views consist of your filtering options only, not search or sorting options.

Policy Details​

Click a policy to display its details. The policy's domain and type determine the available details.

Potential Summary tab information:

  • The number of alerts in the past 7 days
  • Description: Additional policy details
  • Frequency: The frequency of assessment
  • Severity: The severity of an event triggered by the policy
  • Domain: The highest level policy category
  • Type: A policy's subcategory
  • Action on failure: The action to take when a policy failure occurs
  • Scope: The registries associated with the container vulnerability policy
  • Created by: The user who created the policy
  • Updated on: The last date the policy was updated
  • Updated by: The user who last updated the policy

Potential additional tabs:

  • Query
    • For Lacework Query Language (LQL) policies, the tab contains the entire LQL query.
    • For non-LQL-based policies, the tab contains the expressions and result of the expressions.
  • Exceptions
  • Context: Remediation steps