To find one app, type its name in Search by Name. To narrow the table, select Add Filter and choose one or more of these filters:

Country is where the app’s publisher is headquartered, not where your user was. For example, filtering for Australia returns Atlassian, because Atlassian is an Australian company. To see where your users connect from, use Logins.

Ignore an app

Ignoring an app does not change how its traffic is treated; it simply sets a flag that the Status filter reads.

Its purpose is to help with your reviewing of apps. You might already know your organization uses Microsoft 365, and that row crowds out the apps you have not seen before and need to review. Ignore the apps that you expected, and then filter on Not ignored. This will give you a clear view of the apps you need to review.

Select an app to open its page.

Overview shows the publisher, the country in which the publisher is headquartered, the app category, and any Service Tunnels or ITP policies that already reference the app. If a Service Tunnel or ITP policy is listed, someone has already decided how CSE handles the app. Check that entry before you add the app anywhere else.

The Domains list on an app’s page appears only for custom apps, because you entered those domains yourself. For apps from the CSE catalog, the page does not show which domains CSE uses to recognize the app. For example, CSE might count both slack.com and slack-edge.com as Slack, but the page does not show you that list.

This matters if you also handle the app by domain somewhere else, such as in a firewall rule or an ITP policy’s Domain and URL Bypass list. App Discovery cannot tell you whether those entries cover every domain CSE counts as that app.

Access log lists one entry per device and user pair, with the time of that pair’s most recent access. Use it to see who accessed the app from which device.

Warning: An entry is written whether the request was allowed or blocked, and the log does not say which. Read an entry as an access attempt. For the allow or block verdict, use SIA access logging.

You can act on a discovered app in two ways, from buttons on its page. A Service Tunnel is a routing decision. An ITP policy is a policy decision.

Add to Policy

Pick an ITP policy, and then select Allow or Block for the app. Block adds the app to the policy’s Application Blocking list. Allow adds it to the policy’s Application Bypass list, so its traffic is not inspected. The dialog shows how many devices the policy applies to, so you can see how far the change goes before you save it.

Add to Service Tunnel

Pick a Service Tunnel, and then select Include or Exclude for the app. Include sends the app’s traffic through the Service Tunnel. Exclude sends it straight from the device, outside the tunnel.

Including an app changes the IP address it sees your traffic come from. The traffic arrives from your Global Edge or Private Edge egress IP address instead of the user’s own network. If the app admits only traffic from addresses you have allowlisted, include it and allowlist that egress address once. See Secure SaaS Applications with IP Allowlisting.

Note: ITP does not evaluate traffic carried by a Service Tunnel. If you include an app in a Service Tunnel, its ITP policy stops applying to it. Choose one or the other for an app. Configuring both does not combine them.

Two limits apply to what you can select:

• Not every app can be routed through a Service Tunnel. The apps available in a Service Tunnel are a subset of the ones App Discovery shows. If you find an app in discovery but cannot select it in a Service Tunnel, contact SonicWall Support to ask for it to be added.
• Category is not yet available in ITP policies. You can filter the table by category, but an ITP policy matches named apps. To act on a category, filter the table by it and then select those apps in the policy individually.

You can also select apps from the policy side. In an ITP policy, pick them in the Application Blocking and Application Bypass sections. In a Service Tunnel, pick them in the include and exclude lists. Custom apps are selectable in both.

If your users access an app that the catalog doesn’t cover, such as an internal tool on your own domain, create a custom app for it. CSE then attributes requests to the domains you list, and the app becomes selectable in ITP policies and Service Tunnels, like any other. See Create a Custom Application.

If the app is a public one that the catalog ought to cover, ask your SonicWall account team to add it. Adding it to the catalog covers every organization, but it takes longer than creating a custom app yourself.

• A third-party web filtering solution on the device that intercepts DNS requests stops App Discovery from seeing them, because the requests never reach CSE. Apps accessed from that device are missing from the table.
• CSE matches apps by domain, not by fully qualified domain name (FQDN). Requests to every host under a domain count toward the same app, so you cannot split one domain into separate apps by subdomain.