Security Center:Create a network object

Edition limits

• Subscription: Ultimate (if your edition does not support this feature, performupgrade).

  Note

  The protection edition of the server must be set to the edition you purchased. For more information, see Bindserverprotection edition.

• Pay-as-you-go:ActivatedHost and Container Securitypay-as-you-go (if not activated, go topurchase).

  Note

  The server protection level must be set toHost and Container Protection,see Bind the protection level of a server.

Prerequisites

You have enabled the malicious behavior defense feature for your assets. For more information, see Use the proactive defense feature.

Procedure

1. Log on to the Security Center console.

2. In the left-side navigation pane, choose Protection Configuration > Container Protection > Container Microsegmentation. In the upper-left corner, select the region where your assets reside: Chinese Mainland or Outside Chinese Mainland.

3. On the Container Microsegmentation page, click the Network Object tab.

4. On the Network Object tab, click Create Network Object.

5. In the Create Network Object panel, set the following parameters.

   Parameter	Description
   Object Name	Enter a name for the network object.
   Namespace	Select or enter the namespace of the network object. Note The namespace corresponds to a cluster namespace and supports wildcard matching. For example, you can enter a*.
   Application name	Select or enter the application name for the network object. Note The application name is the value of the Pod tag with the key App. Wildcard matching is supported. For example, you can enter a*.
   Image	Select or enter the container image to protect.
   Tag	Select or enter the tags of the Pods to protect. You can select multiple tags. Tags are business attributes attached to a Pod after it launches in a Kubernetes (K8s) cluster. You can add custom tags to identify Pods. Tags serve as the fundamental matching criteria for isolation rules.

6. Click OK.

   The new network object is added to the network object list.

   • You can click Edit or Delete in the Actions column to modify or delete the network object.

   • You can also select multiple network objects and click batch delete below the list to delete them in batches.

     Note

     A network object can be deleted only if it is not used in any Container Microsegmentation rules.

Next steps

After you create source and destination network objects, you can create a defense rule between them to allow, generate alerts for, or block anomalous traffic from the source to the destination. For more information, see Create a defense rule.