The setting(s) marked with the blue dot show that a value has been changed from the inherited value.
In this case, the configuration was probably done at the Managed Network layer, but then at either a group or controller level, Deny inter user traffic was enabled ... while it's disabled at that lower level in the heirarchy.