How to Manage Zones in Dell Threat Defense

Zones are used to manage and organize devices in a Dell Threat Defense administration console.

Affected Products:

• Dell Threat Defense

A Dell Threat Defense administrator may:

• Add Zone
• Add Zone Rule
• Remove Zone

Click the appropriate step for more details.

Add Zone

By default, devices are automatically added to the "unzoned" zone. It is highly recommended to create additional zones to manage device policies and product updates.

1. From a web browser, go to the Dell Threat Defense administration console at:
   • North America: https://dellthreatdefense.cylance.com
   • Europe: https://dellthreatdefense-eu.cylance.com
   • Asia Pacific: https://dellthreatdefense-au.cylance.com
2. Log in to the Dell Threat Defense administration console.
   
3. Click the Zones tab.
   
4. Under the Zones tab, click Add New Zone.
   
5. Enter a Zone Name.
   
   Note: The Zone Name may be a maximum of 32 characters.
6. Select a Policy to be applied to the zone from the drop-down menu.
   Note: The base configuration only contains the Default Policy. Reference How to Modify Policies in Dell Threat Defense to add additional policies.
7. From the drop-down menu, select the Value as Low, Normal, or High to indicate how threats are classified within a zone.
8. Once Zone Name, Policy, and Value are selected, click Save.

Add Zone Rule

By default, devices have to be manually moved into a zone by an administrator. Zone Rules automate this task.

1. From a web browser, go to the Dell Threat Defense administration console at:
   • North America: https://dellthreatdefense.cylance.com
   • Europe: https://dellthreatdefense-eu.cylance.com
   • Asia Pacific: https://dellthreatdefense-au.cylance.com
2. Log in to the Dell Threat Defense administration console.
   
3. Under the Zone tab, click the appropriate zone to add a Zone Rule.
   
   Note: The example Test zone name may differ in your environment. Refer to the Add Zone section for creating additional zones.
4. Click Create Rule.
   
5. New devices are automatically added to the zone if When a new device is added to the organization is checked. Choose to either leave checked or clear this value.
   
   Note: If more than one zone would add the new device, the last modified rule wins if there is conflict.
6. If any identifying attribute (such as IP, hostname, operating system, or domain) changes, devices are automatically added to a zone if When any attribute of a device has changed is checked. Choose to either leave cleared or check this value.
7. Choose at least one rule from the drop-down menu:
   • Device Name
   • Distinguished Name (LDAP)
   • Member of (LDAP)
   • Domain Name
   • IPv4 address in range
   • Operating System
   
   Note: More than one rule may be added by clicking the + sign.
8. Populate the criteria for one or more rules that are selected from Step 6.
   
9. Select either:
   • If ALL of the following conditions are met - This option requires all rule criteria to be met in order for a device to automatically be added into a zone.
   • If ANY of the following conditions are met - This option requires at least one to be met in order for a device to automatically be added into a zone.
   
10. Select either do not apply or apply Zone policy for devices that are added to the zone.
    
11. Check Apply now to all existing devices to have previously registered devices added to the zone that meet the rule criteria.
    
    Note: Checking Apply now to all existing devices takes up to five minutes to complete. This delay depends on the number of queries being performed and the size of the environment.

Remove Zone

Sometimes, a zone may no longer be necessary. The Dell Threat Defense tenant provides administrators the ability to remove zones.

1. From a web browser, go to the Dell Threat Defense administration console at:
   • North America: https://dellthreatdefense.cylance.com
   • Europe: https://dellthreatdefense-eu.cylance.com
   • Asia Pacific: https://dellthreatdefense-au.cylance.com
2. Log in to the Dell Threat Defense administration console.
   
3. Under the Zone tab, click the appropriate zone to be removed.
   
   Note:

   • The example device name may differ in your environment.
   • Devices are not deleted when a zone is removed.
4. Click Remove.
5. On confirmation, click Yes.
   
   Warning: A removed zone action cannot be undone. The zone must be re-created if this action occurred by mistake.

To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.