Policies
Monocle policies define how traffic is evaluated and what decision is returned for it: Allow or Block.
Where the decision is enforced depends on your integration. With an SDK integration, your application or infrastructure enforces it. With an edge integration (Cloudflare, CloudFront or Fastly), Monocle enforces it for you on the paths you choose; see Assess & Enforce.
Policies are available on Team plans and above.
Policy overview
The Policy page summarizes your current policy configuration and how it's affecting traffic.
From the Policy page, you can see:
- Your current policy strategy
- Sessions Evaluated, Sessions Blocked and Traffic Impacted
- An Allowed vs Blocked Over Time chart
Use this page to understand how your policy is performing before you change its configuration.
Explore policy activity
Select Explore on the Policy page to open Explorer on its Policy tab, where you can filter and investigate which traffic was allowed or blocked. See Explorer.
Configuring a policy
Select Configure to open Configure Policy. It has these sections, from top to bottom:
| Section | What it does | Plan |
|---|---|---|
| Scope | The paths this policy protects. Edge integrations only. | Team |
| Block Strategy | A preset that configures the traffic rules | Team (Custom is Pro) |
| Traffic type | Which traffic types to block, and the Max TTL | Pro |
| Service | Override the strategy for specific providers | Pro |
| Geo | Restrict or allow traffic by country of origin | Pro |
Select Save to apply your changes. They affect how future traffic is evaluated.
Scope
Edge integrations only. Scope sets the paths this policy protects, and connected integrations apply them at the edge. Add exact paths such as /login or sections such as /checkout/*.
For how enforced paths work alongside assessment, the path rules, and what visitors see, read Assess & Enforce.
Block Strategy
Choose a preset to configure the traffic rules automatically.
| Strategy | What it does | Best for |
|---|---|---|
| Allow all | Allows all traffic, with no blocking rules applied | Monitoring only |
| Normal | Blocks all traffic from Spur-identified anonymous services | Most use cases |
| Aggressive | Blocks all traffic from anonymous services | High-risk environments |
| Custom (Pro) | Configure each rule yourself | Granular control |
The Traffic type (including Max TTL), Service and Geo sections can only be edited when the strategy is Custom.
If you switch away from Custom, your traffic type, Max TTL, blocked services and geo settings reset to the defaults of the strategy you chose, and Monocle asks you to confirm first. If you switch to Normal or Aggressive, services you added to Exempt services are kept and saved with the new strategy, alongside the strategy's own exempt services. Allow all clears them.
Traffic type (Pro)
With the Custom strategy, choose which traffic types to block:
| Rule | What it blocks |
|---|---|
| Deny anonymous | All anonymous users; all other users are allowed |
| Deny anonymous named | Anonymous users, but excludes unlabeled proxies |
| Deny VPNs | Connections coming from VPNs |
| Deny proxies | Connections coming from proxies |
| Deny datacenter | Connections coming from datacenters |
| Deny RDP | Connections from Remote Desktop Protocol (RDP) sessions |
| Deny IP mismatch | Requests where there's a mismatch in IP information |
Max TTL (Pro)
In the Traffic type section, Max TTL (seconds) is the maximum time a policy decision stays valid. Each preset strategy sets its own Max TTL. With Custom, you choose it yourself.
Service (Pro)
Override the strategy for specific providers:
| Control | What it does |
|---|---|
| Blocked services | Block assessments from these services, ignoring all other rules |
| Exempt services | Allow assessments from these services, ignoring all other rules |
Services use Spur's identifiers, such as GOOGLE_ONE_VPN or ICLOUD_RELAY_PROXY. Start typing to search.
Geo (Pro)
Restrict or allow traffic by country of origin:
| Control | What it does |
|---|---|
| Blocklist | Block assessments from these countries |
| Allowlist | Allow assessments from only these countries |
Countries use ISO codes, such as US, GB or DE. Start typing to search.
Plan availability
| Feature | Community | Team | Pro | Enterprise |
|---|---|---|---|---|
| View the Policy page | Upgrade prompt | Yes | Yes | Yes |
| Configure a policy (Scope, Allow all, Normal, Aggressive) | No | Yes | Yes | Yes |
| Custom strategy, Traffic type, Max TTL, Service and Geo | No | View only | Yes | Yes |