Machines map

The Map layout of the Machines page groups your machines into zones and gives a whole zone its settings at once. You draw zones, add policies, and wire each policy to the whole account, a zone or one machine; every machine a policy reaches follows it.

What the map is

The map is a second way to see the Machines page, built for setting many machines up at once. Zones are boxes that hold machines, policies are named sets of settings, and wires connect a policy to what it applies to. Change a policy once and every machine it reaches follows.

Layout at the top of the page switches between Map, which the page opens on, and List, one row per machine. The list is part of the page address (?layout=list), so a link to it opens it.

The three panels

• Parts, on the left: Zone, Configuration and one entry per kind of policy, every machine with a search box above them, and New machine. Drag a part onto the map, or click it to add it in the middle of the view. Type in the search box to find a machine by name, product, OS, status, zone or note; the matches stay bright on the map, and Enter or a click takes you to one.
• The map, in the middle. Hold Space and drag, or drag with the mouse wheel button, to move around (on a touch screen, drag with one finger). Use the mouse wheel or + and - to zoom, and Fit to see everything. Tab moves between the boxes on the map and Enter selects one.
• The inspector, on the right: the details of whatever you selected, with a button or a picker for every change you can also make by dragging. For a machine it also shows its note and history.

Every machine on your account is on the map. One you have not placed yet waits in Not placed, under everything else, until you drag it into a zone. Drag Not placed by its title to put it somewhere else on the map, or select it and press Delete to hide it; the machines stay, and Show Not placed in the empty map's right-click menu brings it back. Where you put it is remembered in this browser.

Adding to the map

Drag a zone, a policy or a machine from the parts panel onto the map, or click it to add it in the middle of the view. A machine dropped on a zone goes into that zone. New machine asks for a name and adds the machine in the middle of the view; New machine here on the empty map's right-click menu adds it where you clicked. Either way you stay on the map. To install it, right-click it and choose Install.

Selecting several

Drag across the empty map to draw a box: every machine and policy it touches, and every zone it holds whole, is selected. Shift, Ctrl or Cmd+click adds an item to the selection or drops it, and Ctrl+A selects everything. Escape clears it.

Items snap to a grid as you drag, so machines dropped near the same row or column line up exactly; hold Alt to place one freely. Drag any selected item to move them all. Right-click one of them, or use the inspector, to act on all of them at once: Move to a zone, Wire a policy to all, Remove from map, Delete, or Delete machines for good. Changes made together are saved together and come back together with Undo.

Right-click

Right-click anything on the map for what you can do with it: a machine, a zone, a policy, a wire, Whole account, or the empty map. The menu offers everything the inspector does for that item, so you can work without leaving the map. A machine's menu also has the actions of its row on the list: Configure, Install, Rename, Notes, Uninstall and Delete machine, plus Show events and Remove from map. Notes opens the machine's note in the inspector, ready to write; its history and comments are under it. Show events opens the machine's events, on the Map layout for es-python; double-clicking the machine does the same. Install and Uninstall open the command panel over the map, with the same choices as on the list; close it to carry on. On the empty map the menu adds a zone, a policy or a machine right where you clicked. The menu key or Shift+F10 opens it from the keyboard.

To delete something, select it and press Backspace or Delete. The map asks first: Enter deletes it, Escape keeps it. A zone, a policy or a wire comes back with Undo.

On a machine, Delete is Remove from map: the machine goes back to Not placed and keeps its events, and Undo puts it back. To delete a machine and all its events for good, right-click it and choose Delete machine. That cannot be undone. The machine disappears at once, and its events are cleared in the background within a few minutes.

Zones

A zone is a box you draw around machines that should share settings, such as Production or Payments. A zone can sit inside another zone, and then it gets what is wired to both.

• Drag a machine onto a zone to put it there, or onto the empty map to keep it on the map in no zone. Drag it back onto the parts panel or into Not placed to take it out again. The inspector's Place picker does the same.
• Drag a zone by its title to move it, or drop it on another zone to put it inside. What is inside a zone moves with it. The inspector's Inside picker does the same.
• Drag the corner handle to resize a zone, or type its Size in the inspector. Click the arrow next to its name to fold it down to its title.
• Give a zone a Severity (Critical, High, Medium or Low) from its right-click menu or the inspector, to mark how much the machines in it matter. The zone takes that colour and shows the word in its title. It changes nothing the machines do.
• Delete a zone from the inspector. What was inside it moves up to the zone around it, or to the account level.

A machine in Not placed and a machine on the map in no zone get the same settings, except what is wired to Not placed itself.

Configuration

A configuration is everything a machine can be set to, in one policy: the templates it links, event rules, what to watch, outbound connections, web protection and unique event. Each part sits in its own fold in the inspector.

Templates are linked, not copied. Switch a template on and every machine the configuration reaches follows it, including later changes to that template. The configuration's own settings come first, and a template fills only what they leave unset. A template's account-wide settings (blocked events, auto-block and blocked client addresses) stay with Apply on the Templates page.

Your account starts with a Default configuration wired to Not placed, so a new machine is protected from the moment you add it. It links every template you can see and turns on web protection: every client and check setting, and a rate limit of 10 requests per 10 seconds that blocks a client over it. Change it, rewire it or delete it like any other policy; a deleted one stays deleted.

Policies

A policy is a named set of settings of one kind:

Select a policy to change its settings in the inspector. A setting left at Not set leaves the decision to the levels around it. A policy wired in several places is still one policy: change it once and every place it is wired follows. A machine a Raise rule reaches is billed at the Raise rate.

Wires

A wire says where a policy applies. Drag from the dot on a policy's right edge and drop it on a zone, a machine, Not placed, or the empty map, which means the whole account. A wire to Not placed reaches every machine with no place on the map, new ones included; a machine leaves it when you place it. In the inspector, pick a target on a policy and press Wire, or pick a policy under Wired here on a zone or a machine.

Point at anything to light up its wires; Wires: Selected hides the others. To remove a wire, select it and press Delete (then Enter), or use Remove wire in the inspector.

Which setting wins

For each machine, settings are combined from the furthest level to the closest:

1. Your account settings on the Filters page.
2. Policies wired to the whole account.
3. Policies wired to Not placed, while the machine has no place on the map.
4. Policies wired to the zones the machine is in, the outermost zone first.
5. Policies wired to the machine itself.
6. The machine's own settings in its Configure window.

Rules add up across every level, and so do outbound rules, which are checked closest level first. For a single setting, the closest level that sets it wins. When two policies at the same level disagree, the stricter value wins (on over off, deny over allow, block over report) and the wire that lost shows an amber !.

Saved as you go, with Undo

Every change is saved as you make it. A line under the map says Saved and what changed, for example "Saved. web-01 gains 3 rules", and you have 8 seconds to Undo. Moving, resizing and renaming save on their own and say Saved. The map asks first only before some deletes: the Delete key, several items at once, or a machine with its events.

If EyalSec refuses a change, the line turns red and says why. If the connection drops, nothing is saved and the map shows everything where it was.

A machine's own settings

A machine's own settings in its Configure window always win over the map. A machine that has some, event rules included, carries a small tag on the map, such as 2 local, and its inspector lists each one with what it hides. Clear removes that one setting so the map decides it again. You can also change a setting right in the inspector: under Effective configuration, pick a new value and it becomes the machine's own, the same as setting it in Configure. Event rules and outbound rules are changed in Configure. Use Open Configure, or right-click a machine and pick Configure, to open its Configure window. Double-click a machine to see its events on the events page.

Inherited in the Configure window

When the map gives a machine settings, its Configure window lists them at the top under Inherited from the map, each with the zone and policy it comes from. They are read-only there, so change them on the map. A setting you make in the window wins over them.

On a phone

On a narrow screen the map is for looking and selecting: drag to move around, pinch to zoom and tap to select. The inspector opens from the bottom of the screen and every change is made there. + Add opens the parts panel.

Everything on the map can also be read and changed with the machines map API.