Which policy strategy should I use?
Allow All applies no blocking rules. Normal is recommended for most use cases. Aggressive blocks all anonymized traffic and carries a higher risk of false positives. Custom (Pro) gives access to all standard options plus more granular assessment attribute-level configuration.
Similar questions
What is the difference between using Monocle to monitor vs. enforce traffic decisions?
Monitor is passive: Monocle provides visibility into how users connect to your application without impacting users or taking any blocking action. Enforce applies actions such as blocking or allowing traffic based on Monocle's assessments. Most users start with a monitoring phase before configuring and enabling enforcement.
What is the difference between Raw Assessment and Policy API?
With Raw Assessment, you decrypt and evaluate traffic yourself for full control. With the Policy API, Monocle evaluates traffic and returns a decision directly, which is simpler to implement.
Where does enforcement actually happen?
In most setups, enforcement happens in your own infrastructure, such as backend logic, API gateways, or middleware. For Cloudflare integrations, enforcement can happen at the edge and is directly configurable via the Monocle UI.
Can I block specific services or countries?
Yes. With a Team plan, you can block or allow specific services, such as VPN providers, and block or allow specific countries using country codes.
Do I need a backend to use Monocle?
No. You can use Monocle to gain visibility into traffic intelligence via the Monocle UI without acting on it. With a supported integration like Cloudflare, traffic can be enforced directly from the UI based on policy configuration. A backend is only required if you want to decrypt assessments or apply custom enforcement logic.
Related guides & explainers
Understanding Monocle Application Health Status
Each Monocle application shows a health status dot indicating whether it's actively sending traffic. Learn what each color means, how to set each application's health threshold, how health alert emails work, and what to check if an application goes quiet.
Expanding IP and Service Rows in the Explorer
Click any IP or service row in the Monocle Explorer's breakdown tables to expand an inline detail panel, without leaving the table.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.