CloudGuard VMSS Policy "__monitor__-restrictive-policy" question?

[HeikoAnkenbrand]

I have a question about the CloudGuard VMSS Policy "__monitor__-restrictive-policy".

Nothing is described in the admin guides to CloudGuard or CME:
- CloudGuard Network for Azure VMSS R80.10 and Higher Administration Guide
- Cloud Management Extension R80.10 and Higher Administration Guide

From the local SEs I only get the information to enter "any, any, any, accept" here.

I think this policy controls access to the CloudGuard public IP of each VMSS instance.
If that's the case, I don't think it should be a "any, any, accept" rule.

Which ports should be used here. I think these should be the typical ports between SMS and firewall gateway:
257 Log, 18192 CPD, 18192 CPD_amon, 18211 CP_ica_push, 18264 FW1_ica_service, 443 GAIA Web, 22 SSH

Where can I find more information here?

Can someone from the CloudGuard team provide information on this topic.