Hi @Dwee
To simplify ENS Firewall Adaptive mode functionality, its main feature is to help build your Firewall Rules policy by "learning" what network activity is happening on the Firewall client(s). Instead of having to manually create every single firewall rule, you might need in your environment, Adaptive helps with "what's in my environment now?" list of rules to help you get started. Those "learned" rules are then uploaded to ePO and processed, so the Firewall admin can use those rules to "build" an appropriate firewall policy. You enable Adaptive mode on a system or group of systems in order to "learn" what application network traffic is going in/out of those systems.
Once you have a list of "learned" Firewall client rules from those clients, you will then need to review these rules to determine which need to be added to the Firewall Rules policy for your clients. The applied Firewall Rules policy is applied to whatever firewall clients you have assigned to them. If you've added a firewall rule for Webex (as the example you mentioned), then you will need to review all the "learned" firewall client rules and determine the "end" rule to add to your policy. Usually, you only need to add one or a couple of rules for an application (depending on how strict you want the rules to be). The "learned" client rules will be specific to each system that it was "learned" on, however, after adding the client rule to the Firewall Rules policy, you will need to modify the rule to reevaluate the specifics (e.g. the client rule will have the MD5 hash of the rule, which would only work for that specific Webex executable). Unless you can guarantee that all your managed clients are running that exact same MD5 hashed executable, you might want to consider removing that attribute from the rule. Null values (or <BLANK> equals an "ANY or ALL" pattern (e.g. ignore that criteria). Add what firewall client rules you need, and ignore the rest (which the Firewall will block once Adaptive mode is disabled and local client rules are purged by disabling the "RETAIN EXISTING CLIENT RULES" option). Tweak the rules as needed (e.g., you don't need 10 Webex rules; consider combining rules into one or a couple, like if the remote port, or executable file path location, or IP address, etc. differs.
Your Firewall Rules policy will be unique to your environment, your security needs, and sometimes even by client type (servers vs workstations vs laptops). You can use the Firewall Catalog to "share" firewall rules/groups/etc. amongst multiple firewall rules policies to help manage them more efficiently.
You Deserve an Award
