Before writing segmentation policy for a three-tier application, the security team needs an accurate map of which workloads talk to which and on what ports, so it can build an allowlist that permits only the observed, required flows. Which Cisco Secure Workload capability provides this?

Cisco Secure Workload collects flow and process telemetry from agents or other sources on each workload and uses it to perform application dependency mapping, also described as automatic policy discovery. It groups workloads into clusters, identifies which clusters communicate and on which ports and protocols, and generates suggested allowlist policies that permit only the observed, required conversations. Administrators review and refine those suggestions, analyze them against live traffic, and then enforce them for microsegmentation. That sequence is what makes it possible to write a zero-trust policy without guessing. Cloud asset discovery belongs to Cisco Multicloud Defense; it inventories cloud accounts and resources but does not map workload-to-workload dependencies. Retrospective file analysis is an endpoint and malware capability that revisits file verdicts when intelligence changes, which has nothing to do with flow mapping. URL category filtering governs user web access by website content and does not describe internal application flows. Exam caveat: dependency mapping is only as good as the observation window, so include periodic jobs such as backups and month-end processing before enforcing. Operational check: run policy analysis to compare the proposed allowlist against live traffic, confirm there are no unexpected escaped flows, and only then switch the scope to enforcement.