Network Security Agent: Troubleshoot App-ID
Diagnose application access failures caused by App-ID classification issues using the
Troubleshooting agent in Strata Copilot.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- Strata Cloud Manager Pro
- This feature is currently in Beta and available on request.
Contact your account team to enable the feature.
- Superuser role (for agent administration, onboarding, and
managing permissions)
- Network Administrator or Security Administrator role (for
agent interaction)
|
The Troubleshooting agent automates the diagnosis of application access failures caused
by App-ID classification issues. This workflow reduces the time to identify
App-ID-related access failures from hours of manual log correlation to minutes of
automated analysis.
The agent executes the following diagnostic stages:
- Symptom intake—Gathers the affected user, application, location, timeframe,
and symptom scope (single user vs. multiple users) to establish the investigation
parameters.
- Classification analysis—Determines how the target traffic is currently being
classified by App-ID and identifies the cause of any classification discrepancy,
such as a content update that modified an App-ID, a custom App-ID conflict, or an
application dependency issue.
- Policy impact analysis—Correlates the App-ID classification with your
security policy rules to identify which rule is now matching (or not matching) the
traffic, and determines whether the resulting action aligns with your security
intent.
- Root cause and remediation—Synthesizes findings into a root cause
determination (by-design block vs. misconfiguration), provides specific remediation
steps with blast radius assessment, and includes verification steps to confirm the
fix.
Investigate an App-ID Classification Issue
Use the Troubleshooting agent to diagnose why users lost access to an application due to
an App-ID classification issue.
- Open Strata Copilot in Strata Cloud Manager.
- Select Troubleshooting from the
@Agent drop-down.
- Describe the App-ID classification issue. Mention App-ID or classification
changes in your query so the agent investigates the correct failure domain. For
example:
- "Traffic to our SaaS app is now classified as a different App-ID
than it was yesterday"
- "After the last content update, our CRM application is being
blocked—I think the App-ID changed"
- "File uploads in our project management tool stopped working and
the traffic logs show a new App-ID I haven't seen before"
- (Optional) Provide additional input if prompted. If your query does
not include enough detail, the agent presents an Activity Plan and prompts you
to provide more information before generating an investigation plan. Enter the
requested details and click Submit.
- Review the plan the agent presents. The agent analyzes your query and generates
an investigation plan tailored to the reported issue. Click
Execute to proceed with the plan, or click
Modify to refine it before execution.
- Provide additional details if prompted. Depending on the information
available, the agent may present a clarification form requesting details
such as the affected application or destination, the observed classification
change, and the impact on traffic. Provide as much detail as you can—the
agent uses your responses to narrow the investigation scope.
- Review the execution results. After the investigation completes, the agent
presents an Execution Summary that includes:
- The root cause of the classification issue (content update, custom
App-ID conflict, dependency issue, or other cause) and the specific
App-ID change that affected your traffic.
- Whether the block is by-design (policy is correctly enforcing the
classification) or a misconfiguration (policy needs updating to reflect
the correct App-ID).
- Recommended remediation steps, such as adding a new App-ID to an
existing allow rule or creating an application filter.
- Click View Full Report for the complete
diagnostic analysis.
App-ID Troubleshooting Scenarios
The following scenarios illustrate how you can use the Troubleshooting agent to diagnose
and resolve application access failures caused by App-ID classification issues.
Scenario 1: App-ID Merge Breaks an Allow Rule
- Scenario: Multiple users report they can no longer access an internal
collaboration platform. The issue started after a content update installed
overnight.
- Query:
"The entire product team lost access to our internal wiki this morning—it was
working fine yesterday"
- Agent Finding: Content update 8891 merged App-ID
custom-wiki-app into the broader
enterprise-wiki App-ID. The security policy rule
"Allow-Product-Tools" references custom-wiki-app, which no
longer matches the reclassified traffic. The traffic now hits the
interzone-default deny rule.
- Remediation: Add enterprise-wiki to the
"Allow-Product-Tools" rule, or replace the specific App-ID reference with an
application filter that covers collaboration tools. Blast radius: other
enterprise wiki applications will also match this rule.
Scenario 2: New App-ID Captures Previously Allowed Traffic
- Scenario: A user reports that file sharing within a SaaS application
stopped working, though the main application interface still loads.
- Query:
"User jdoe can log into our project management tool but file uploads and
downloads are blocked since Tuesday"
- Agent Finding: Content update 8893 introduced a new App-ID
projectmgmt-file-transfer that captures file operations
previously classified under the parent App-ID
projectmgmt-base. The policy allows
projectmgmt-base but does not include the new
projectmgmt-file-transfer App-ID.
- Remediation: Add projectmgmt-file-transfer to the allow
rule, or use an application filter based on the project-management application
category to automatically capture future sub-app additions. Blast radius:
minimal—only the specific file-transfer function is affected.
