Concepts

Connect has a small vocabulary, and most of it builds on one idea: an inventory of what's in your network, and things defined in terms of it. This page explains each concept and how they fit together. The Glossary has the one-line versions.

How Connect collects data

Connect runs in FireMon's cloud. Everything it knows about your network comes from the accounts you set up under Settings > Accounts, one per system it should talk to. An account can do two kinds of work:

• Inventory discovery reads assets from a system into Inventory. Discovery is read-only. It runs as soon as an account is provisioned and again every day, and AWS accounts can also forward events so changes show up within minutes rather than the next day.
• Export pushes something out of Connect: a Group's addresses to an enforcement point, an evaluated change request to a ticketing or policy system, or a decommissioned asset to a CMDB. Exports write only objects Connect manages: address objects on an enforcement point (and, for Palo Alto, the tags that feed a Dynamic Address Group), staging tables and rows in ServiceNow, and rules in a Guardicore ruleset of its own. Your existing firewall rules stay as they are.

Cloud and SaaS systems are reached directly. Systems inside your network with no route in from the internet are reached through the Connector. Integrations lists every supported system and which kind of work it does.

Projects and accounts

A project is a folder. Projects form a tree with your organization at the root, and every account, Group, Boundary, change request, and Decommission action lives in exactly one of them. Roles are granted per project and apply to everything beneath, so projects are how you give a team its own accounts and Groups without giving it everyone else's. One project is fine for a small deployment. See Projects.

An account is one connection to one system: an AWS account, an Azure subscription, a Panorama, a ServiceNow instance. It carries the credentials, an Environment label (Production, Staging, Development, or Testing/QA) you can filter on, optional labels, and its project.

Inventory

Inventory is everything Connect has discovered: cloud resources such as virtual machines, load balancers, and storage, and on-prem assets such as Infoblox networks, Illumio workloads, and Security Manager network objects. Each inventory item carries its IP addresses, hostname and MAC address where the source reports them, its tags, the account and region it came from, and the source's own attributes as raw data.

Cloud resources can also carry posture check results, which is what the Risks column shows. Those come from FireMon Cloud Defense, where your organization uses it; the two products share one inventory.

Groups, Boundaries, and Decommission work on the item types that carry IP addresses, and the Inventory page shows only those types. See Inventory.

Groups

A Group is a named set of IP addresses and CIDRs that Connect maintains for you. Instead of listing addresses, you define criteria over inventory (tags, resource type, account, region, CIDR, attribute values, and so on), and the items that match are the Group's members; their addresses are the Group's IPs. When inventory changes, the Group follows.

A Group's Update setting decides how closely it follows:

• Automatic Groups add and remove members on their own as inventory changes. How quickly depends on the source; see Automatic and Manual.
• Manual Groups hold every change as a pending change until someone approves it. Every change waits for a person.

A Group can also include other Groups (nested Groups), whose IPs are added to its own regardless of the criteria.

Groups are used three ways, and one Group can be used all three ways at once:

Use	How
Export	Connect pushes the Group to an enforcement point and keeps it in sync: an Azure IP Group, a Palo Alto Dynamic Address Group through Panorama, or a VMware NSX Group. You reference that object in your own policy.
Dynamic list	Every Group is published at an HTTPS URL, in the formats Palo Alto, Check Point, and Fortinet firewalls fetch directly, so a device Connect doesn't push to can still consume the Group.
Boundaries	A Boundary can name a Group as a source or destination, so policy is written in terms of "the payment servers" and follows the Group's membership.

Membership caps at 10,000 items. See Groups.

Boundaries

A Boundary is a rule about firewall rules: a description of the change requests it applies to, and what happens to them. It has a statement (the request type, sources, destinations, services, and conditions on the request's fields) and a result:

Result	Meaning
Pass	Requests matching this Boundary are acceptable as they are.
Fail	Requests matching this Boundary are rejected.
Score & Review	Requests matching this Boundary need a person to look at them, and carry the Boundary's score (0 to 100) as a measure of concern.

A Boundary is either enforced or not; an unenforced Boundary is kept but ignored. It can also name targets: accounts a request is exported to when it passes or is sent for review.

Sources and destinations in a Boundary can be Any, a CIDR, a Group, or an inventory item. A CIDR, Group, or inventory item carries a comparison (contains or equals) that can be negated. A Boundary written against a Group keeps working as the Group's membership changes. See Boundaries.

Change requests

A change request describes a firewall change someone wants: one or more rules, each with an action (Allow or Deny), sources, destinations, and services, plus context such as a justification, an owner, an expiration, and ticket references.

When a request is saved, Connect evaluates every rule against every enforced Boundary in your organization and sets the request's state:

State	Meaning
Pending	Saved and being evaluated.
Fail	At least one Fail Boundary matched, or the request is invalid. Any Fail outweighs any Pass.
Pass	No Fail Boundary matched and at least one Pass Boundary did.
Review	No Pass or Fail Boundary matched. If Score & Review Boundaries matched, the request carries the highest of their scores. Your organization can choose a different default for the no-match case; see The default result.
Error	Evaluation couldn't complete.

Each Pass or Score & Review Boundary a request matches exports it to that Boundary's targets, whatever the request's overall state: Guardicore receives it as segmentation rules, ServiceNow as rows in a staging table. See Change Requests and, for automation, the API.

Decommission

Decommission finds assets that appear to have been retired and gets them dealt with. A Decommission action is a set of criteria that identifies such assets: typically items that have been deleted from their source, optionally narrowed by account, type, tags, and how long since the asset was last seen or last matched a firewall rule. Each item an action finds is a candidate.

An action is Automatic or Manual. Automatic actions approve every candidate as it's found; Manual actions hold candidates as Pending Review until someone approves or rejects them. Approved candidates are exported to the action's destination, currently ServiceNow, and every export attempt is recorded under History. See Decommission.

The Connector

The Connector (optional) is a small agent you run inside your network so Connect can reach systems there: Palo Alto Panorama, VMware NSX Manager, and Infoblox Grid Manager. It makes only outbound connections, pairs to your Connect organization with a single-use registration code, and then polls for jobs: Group exports and inventory discoveries. Everything it does is listed under Settings > Connectors > Jobs. See Connector.

Alerts

Connect can tell you in Slack when a Group's membership changes. Destinations (Slack workspaces and Microsoft Teams tenants) are set up in the FireMon Cloud Defense console, which the Alerts page links to; see Slack. On Connect's Alerts page, each destination shows a Sign In link until you link your chat user (for Slack, send /fmcd signin in any channel); once linked, a checkbox appears for receiving Group alerts as direct messages. A message names the Group and links to it, with the resource that changed or, when several changed at once, counts of what was added and removed. Group alerts go to Slack destinations.