Common Spirion Agent Policies

Typical Agent Policies — Patterns and Purpose

Policies are named configuration profiles that bundle logging, polling, disk thresholds, proxy, and Spirion Sensitive Data Watcher (SDW) monitoring paths.

The policies here represent the most common categories admins create:

1. Debug Logging

Purpose: Temporary troubleshooting policy assigned to agents experiencing issues.

When used: Assigned to a specific agent to capture detailed diagnostic information for a support case or bug reproduction. Generates verbose logs without the extreme volume of Trace.

2. Full Logging

Purpose: Maximum verbosity — captures everything including Trace-level events.

When used: Escalated troubleshooting when Debug-level logs aren't sufficient. Produces very large log files. Should only be assigned temporarily — log files can consume significant disk space.

3. Reduced Poll & Logging

Purpose: Minimize Spirion Agent overhead and network traffic in production/steady-state.

When used: For large fleets of agents where frequent polling and verbose logging create unnecessary load on the console and network. Only logs warnings/errors while checking in less frequently.

4. Watcher Policy

Purpose: Configures File and Folder Inclusions/Exclusions for Activity Watcher monitoring.

When used: Assigned to agents that are enrolled in Watcher (file/email activity monitoring). Different groups of endpoints (Targets) may monitor different paths depending on what data they host.

5. Do Not Override

Purpose: A "locked" baseline policy signaling that agents assigned to it should not have their settings changed — essentially a production/steady-state policy.

When used: Marks a group of Spirion Agents as "configured and approved" — a convention to prevent accidental reassignment during troubleshooting. The name is a human signal to other admins, not a technical enforcement.

6. NL-Agent Poll

Purpose: Custom polling interval for a specific agent group (likely named for a location, network segment, or team — "NL" prefix).

When used: When a subset of agents needs a different check-in frequency — for example, Spirion Agents on a slow WAN link polling less often, or agents under active testing polling more frequently.

Common Policy Strategy

Most organizations end up with a pattern like this:

The key insight is that policies are operational profiles — admins create them to address specific combinations of logging verbosity, polling frequency, and monitoring scope, then assign them to Spirion Agents as needed (permanently for steady-state, temporarily for troubleshooting).