Groups
A Group is a named list of IP addresses that Connect keeps current for you. You describe the members with criteria over Inventory; Connect works out the addresses and updates them as resources come and go. This page covers building a Group, keeping it current, and the three ways to use one. The idea itself is in Concepts.
Groups have to be enabled for your organization. If the Groups page says they aren't, contact FireMon Support. Creating, editing, and deleting Groups, and approving pending changes, needs the Administrators role; other roles can view them.
The Groups page
Groups in the navigation menu lists your Groups on four tabs:
| Tab | What it lists |
|---|---|
| All Groups | Every Group. |
| Groups Not Used In Boundaries | Groups no Boundary references. Check here before deleting a Group. |
| Groups With Pending Changes | Manual Groups with changes waiting for approval. |
| Groups Accessed by EDL | Groups whose dynamic list has been fetched at least once, directly or as part of a Group they're nested in. |
The search box matches a Group's name or update type. Each row shows the Group's Stats (how many times its dynamic list has been read, how many Boundaries reference it, its IP and member counts, and how many export targets it has), its criteria, its update type, and its project. Counts shown as 10,000+ are capped; see Group size limits.
Creating a Group
Click New Group and fill in:
| Field | What it does |
|---|---|
| Name | Shown everywhere the Group is referenced, and used to name the object Connect creates when the Group is exported. |
| Update | Automatic or Manual. See Automatic and Manual. Permanent. |
| Project | The project the Group belongs to, which decides who can see and edit it. Permanent. |
| Nested Groups | Other Groups whose IPs are included in this one, on top of whatever the criteria match. See Nested Groups. |
| Export To | The accounts the Group is pushed to. Only accounts that can receive a Group are listed: Azure, Palo Alto Networks, VMware NSX, Cisco Firewall Management Center, and Fortinet FortiManager. An Azure account is listed once it has Read & Write access and a Default Region, and a Palo Alto Networks, VMware NSX, Cisco FMC, or FortiManager account once it has saved credentials and a Connector. See Exporting a Group. |
| Group Candidates | The criteria that select members, and a live preview of the items that currently match. |
Update and Project are set on the first save and shown disabled afterwards. If either is wrong, create a new Group with the right values and delete the old one.
Save when the preview shows what you expect. If the Group is Automatic and has export targets, the form warns that saving exports every current match to those targets. That's the intended effect.
Criteria
Add criteria from the drop-down under Group Candidates. An item is a member when it satisfies every criterion you've added. Within one criterion, any of the listed values is enough, except Attributes, where every row must match.
| Criterion | Matches items whose... |
|---|---|
| Account | account is one of those selected. Only AWS, Azure, and user-defined accounts are offered here; select other integrations with Vendor, Project, or Environment. |
| Attributes | raw attribute at a JSONPath has the value you specify. Choose the path, an operator (=, !=, >, >=, <, <=), the value's type (string, number, or boolean), and the value. See Attribute shortcuts. |
| Check and Check Result | a posture check (from FireMon Cloud Defense, where it's in use) produced a given result (Pass, Fail, Error, or Exempt) for the item. |
| CIDR | IP addresses fall inside one of the CIDRs listed. A discovered network matches when its network address falls inside one of them. |
| Environment | account is labeled Production, Staging, Development, or Testing/QA. |
| Project | account is in one of the selected projects. This selects members; it's separate from the Group's own Project field. |
| Region | region is one of those selected. |
| Severity | failed a posture check of a given severity. |
| Tags | tags include any of the key and value pairs listed. |
| Type | resource type is one of those selected. |
| Vendor | came from one of the selected vendors: AWS, Azure, Illumio, Infoblox, and so on. |
| VPC ID | AWS VPC is one of those listed. |
The preview under the criteria runs the same search the Group runs, so what it shows is what the Group will hold. An empty preview with criteria set means nothing in inventory matches; check Inventory with the same filters.
Attribute shortcuts
An Attributes criterion needs the exact path of a raw attribute, which is time-consuming to find each time. On an account's edit page (Integrations, expand the provider, then the edit button), pick a typical item from that account and click + beside the attributes your team relies on. Those paths then appear as one-click Attribute Shortcuts under the criteria on the Group and Decommission action forms. Keep the list short; the form suggests no more than 15.
Automatic and Manual
Automatic Groups keep themselves current. For AWS and Azure items, a Group is updated as soon as the change reaches Inventory: within minutes for AWS accounts that forward events, otherwise at the daily discovery. For items the Connector discovers, the Group is updated when each Connector discovery finishes. Items from the integrations that connect directly from the cloud (Illumio, SentinelOne, Guardicore, ServiceNow, Security Manager, and Infoblox without a Connector) are picked up when the Group is saved or refreshed. Exports and dynamic lists reflect the new membership. Use Automatic for any Group an enforcement point depends on.
Manual Groups change only when a person approves the change. Connect still watches inventory and records each addition or removal as a pending change. A new Manual Group starts empty, with every matching item listed as a pending addition.
To review pending changes, open the Group and go to the Pending Changes tab. Each row says what would happen (Add, Remove, or Update when a member's addresses changed) and, on hover, why: the item was created, was updated so that it now matches or no longer matches, or was deleted. Filter the list by action, select the rows you agree with, and click Approve. If the Group has export targets, approved changes are exported. Rows you don't select stay pending.
Refresh Group Members (the refresh button on the Group's page) recomputes the Group against current inventory and shows the existing members beside the members the criteria match now. For an Automatic Group, confirming replaces the membership with the new set. For a Manual Group, it rebuilds the pending change list; the members themselves still change only through approval.
Nested Groups
Adding Groups under Nested Groups includes their IPs in this Group, and the IPs of anything nested under them in turn, whatever the criteria say. The IPs tab on the Group's page shows the combined list and says how many nested Groups it includes. Nested membership is included when the Group is exported, published as a dynamic list, or used in a Boundary.
Group size limits
A Group's membership caps at 10,000 items. A Group whose criteria match more than that keeps only the first 10,000. An Automatic Group over the cap shows its counts with a trailing + (Members: 10,000+, IPs: 10,000+), so you know they're not exact.
While a Group is over the cap, Connect also stops removing members from it. A recount that sees only part of the matching inventory can't distinguish a removed resource from one past the cut-off, so removals are skipped rather than risk shrinking a live Group incorrectly. Additions and updates still apply, and exports still run, but they export a partial membership that never shrinks.
A Manual Group gives you no such warning. Counts are only recalculated for Automatic Groups, so a Manual Group over the cap shows stale counts with no +, even though it has the same partial membership and skipped removals. If a Manual Group looks stale, check its criteria against inventory instead of trusting the displayed numbers.
To fix either kind, tighten the criteria (by account, region, type, tag, or CIDR) until the Group is under the cap, or split it into several narrower Groups and export each one. A large Infoblox grid is the most common way to hit the cap; see Infoblox: Dense networks are summarized by CIDR.
Export targets have their own limits, counted in addresses rather than items: an Azure IP Group takes 5,000 entries, an NSX group 25,000 in total, and a FortiManager address group 5,000 per address family; an FMC dynamic object has no known cap. A Group well under 10,000 items can still cross those, because one item can carry a whole CIDR. Each target's page covers what happens at its limit.
Group details
Click a Group's name to open it. The top shows its ID, name, update type, nested Groups, export targets, criteria, and Formats, the dynamic list details. The tabs below:
| Tab | What it shows |
|---|---|
| Members | The inventory items currently in the Group, with their IPs. |
| IPs | The Group's addresses as one list, including nested Groups, with a copy-all button and, for longer lists, a search box. |
| Pending Changes | Changes waiting for approval on a Manual Group. The tab shows a count when there are any. |
| Change History | Every membership change Connect has applied, with the item, its addresses, and when. |
Exporting a Group
Select one or more accounts under Export To and Connect creates and maintains an object on that system holding the Group's addresses:
| Target | Object created | Details |
|---|---|---|
| Azure | An IP Group in the account's default region | Azure |
| Palo Alto Networks | A Dynamic Address Group in the Panorama device group you named, delivered through the Connector | Panorama |
| VMware NSX | An NSX Group, delivered through the Connector | NSX |
| Cisco Firewall Management Center | A dynamic object in the FMC domain you named, delivered through the Connector | Cisco FMC |
| Fortinet FortiManager | An address group per address family in the ADOM you named, delivered through the Connector | FortiManager |
Export creates that address object (and, for Panorama, the tag behind it) and leaves your security rules as they are, so the enforcement point's behavior changes only once you reference the object in your own policy. Each target page covers naming, what happens on rename and delete, and how to verify the object arrived. Connector exports appear as Sync Group jobs under Settings > Connectors > Jobs; see Watching jobs.
Dynamic lists
Every Group is also published at an HTTPS URL that firewalls can fetch on a schedule, so any device that can fetch a list over HTTPS can use the Group. The Formats section on the Group's page lists each format with a link to the vendor's documentation, the URL, and an example curl command:
| Format | Content |
|---|---|
| Palo Alto IP Address | One IP address or CIDR per line, for an External Dynamic List of type IP |
| Fortinet Threat Feed | The same plain list, for a FortiGate IP address threat feed |
| Check Point Generic Data Center | The JSON document the Generic Data Center feature imports, with the Group as one object |
The Palo Alto and Fortinet formats share one URL; the Check Point format has its own. The list includes nested Groups. Every fetch is counted against the Group and any Group nested in it, which is what Accessed in a Group's stats and the Groups Accessed by EDL tab show.
Authentication. The URL requires HTTP basic authentication and accepts either:
- the Group Credentials username and password set under Settings > Group Credentials, which every firewall in your organization can share, or
- an API key as the password, with the username shown on the Group page.
Changing the Group Credentials stops every firewall still using the old ones from receiving updates, so plan the change. API keys are independent of each other, so one can be replaced without affecting the rest.
Alerts
To receive a Slack message when a Group changes, link your Slack user on the Alerts page and select the checkbox. See Alerts.
Deleting a Group
The delete button on a Group's row asks for confirmation and then removes the Group, its membership history, and its dynamic list. Before deleting, check the Groups Not Used In Boundaries tab: a Boundary that references a deleted Group shows it as deleted and needs to be repointed. What happens on the export side differs by target: Azure deletes the IP Group unless a firewall rule still references it (see Azure), while Panorama, NSX, FMC, and FortiManager objects stay in place, so live policy keeps a valid reference. See What the Connector adds.