Segmentation Enforcement, Compliance, and Forensics
This domain tests what happens after policy exists: how enforcement is applied (host or external), how you verify the estate stays compliant, and how you investigate traffic after the fact.
Enforcement paths
- Agent enforcement programs host firewall rules from scope policy (netfilter/nftables on Linux, WFP on Windows). Flows covered by policy pass; everything else drops and is recorded as denied.
- External enforcement pushes intent to FMC-managed FTDs, ACI, load balancers, or ISE security group tags, protecting workloads that cannot run an agent.
- Roll out in stages: visibility → analysis → a limited enforcement window with a safety valve → full enforcement. Exclude agent, sensor, and cluster-management addresses so you cannot lock yourself out of the estate.
Compliance
Secure Workload compares observed traffic against enforced policy and surfaces two useful classes: flows that are allowed but not described by policy (drift or shadow access), and rules that match no traffic (stale and safe to remove). Run this as a weekly operating loop rather than a one-off audit, and document exceptions with the application owner instead of widening rules.
Forensics
- Flow search filters retained data by scope, IP, port, protocol, process, user, and time.
- Agent context answers "which process on which host talked to that address, as which user".
- Vulnerability/package overlay shows whether the host was exposed to a known CVE.
- Alerts and flows export to a SIEM via syslog or API for retention longer than the cluster's flow retention window.
Worked example
An alarm fires on outbound 443 from a database segment. Search flows for scope db-prod, port 443, destination outside RFC1918, over seven days. Three hosts appear, all with process /usr/bin/curl and user svc-backup, and no rule covers that flow, so it also appears as would-be-denied. The process-and-user pairing identifies the backup script; the vulnerability overlay shows no matching CVE. Conclusion: a policy gap or misconfiguration, not an active compromise.
Traps
- Enforcing before analysis and breaking an undocumented dependency.
- Reading "no records found" as "no traffic" - it usually means the agent stopped reporting.
- Assuming Secure Workload flow retention equals your SIEM retention.
- Forgetting that enforcement is stateful and return traffic of an allowed flow is not separately required.