Policy Configuration

How to create, manage, and assign security policies in BlueSentinel.

Overview

Policies define the behavior of each guard on enrolled devices. Every tenant has a default policy that applies to all devices unless overridden by a group or device-specific policy.

Policy Hierarchy

Policies are resolved with 3-level priority (highest wins):

  1. Device override — Policy assigned directly to a device
  2. Group policy — Policy assigned to the device's group (walks parent chain)
  3. Tenant default — The default policy for the organization

Creating a Policy

Navigate to Policies in the admin dashboard and click Create Policy.

Each policy configures all 10 guards independently:

GuardModesKey Settings
USB Guardblock / alert / offAuto-eject, whitelist serial numbers
Network Guardblock / alert / offBlocked ports list, allowed IPs
Browser Guardblock / alert / offBlocked domains, max POST size, proxy port
Process Guardblock / alert / offBlocked process list, kill mode
Clipboard Guardblock / alert / offMax characters, code pattern detection
Screenshot Guardblock / alert / offBlocked tools list
File Watcheralert / offWatch directories, file size threshold, extensions
AirDrop/BT Guardblock / alert / offAirDrop disable, Bluetooth sharing
Print Guardblock / alert / offAllowed printers, print logging
Encryption Guardenforce / alert / offAuto-enable, algorithm selection

Policy Versioning

Every time a policy is updated, its version number is incremented. Agents detect version mismatches during their heartbeat cycle and automatically download the updated policy.

Cloning Policies

You can clone an existing policy to create a variant:

  1. Go to the policy you want to clone
  2. Click Clone Policy
  3. Modify the settings as needed
  4. Assign the new policy to a group or device

Default Policy Settings

The built-in default policy ships with these settings:

  • USB Guard: Block (auto-eject enabled)
  • Network Guard: Block (ports 21, 22, 23, 69, 873, 2049, 3389, 5900)
  • Browser Guard: Block (max POST size 50 KB, 35+ blocked domains)
  • Clipboard Guard: Block (max 300 characters)
  • Screenshot Guard: Block (all capture methods)
  • File Watcher: Alert only
  • Encryption Guard: Enforce

User Exceptions

For individual users or devices that need different rules, use User Exceptions instead of creating separate policies. Exceptions support three types:

  • disable — Disable a specific guard for a device
  • whitelist — Add items to the whitelist (USB serial numbers, domains, processes)
  • mode — Change the guard mode (e.g., block → alert)

Exceptions can be time-bounded with start and end dates.