Review derived network policy rules for a container

When a deployed network policy is not working as expected, reviewing the derived network rules for the specific container can reveal the fully implemented rules.  The output includes the policy id, from, to, port, application, action, ingress and domain. 

Derived Rule Column Definitions:

Obtain Derived Network Rule List

Login to the CLI

#  kubectl -n neuvector exec -it neuvector-manager-pod-name -- cli
# #neuvector-svc-controller.neuvector> login

Obtain a list of containers and get network rules for container

# admin#neuvector-svc-controller.neuvector> show container -c <container_name_substring>
# admin#neuvector-svc-controller.neuvector> show policy derived -c <container_id>

Exit CLI

# admin#neuvector-svc-controller.neuvector> logout
# #neuvector-svc-controller.neuvector> exit

Example Group Policies (not real world example)

Example of a derived rule list for a container with the above policies under Discover mode:

Example of a derived rule list for a container with the above policies under Monitor mode:

Example of a derived rule list for a container with the above policies under Protect mode:

NOTE: Policy ID 0 is for implied rules.  Under Monitor and Protect mode, the last imply rule will either violate (alert but permit traffic) or deny (block traffic).