topic Re: Block IP address in General Topics

Block IP address

atticabank — Tue, 20 Nov 2012 07:54:08 GMT

Hello,

Is there a way to block a specific IP address if you detect multiple threats coming from this IP? For example block an IP address after the detection of 5 threats coming from this IP within 1 minute.

I know you can block an IP but only as an action after the detection of a specific threat.

Kind regards

Re: Block IP address

rmonvon — Tue, 20 Nov 2012 15:34:07 GMT

Yes, you can block a source IP or combo source/dest pair for a time period using custom signatures. Here's an example to block the source IP for threat 10353. Make sure to select 'Combination' for signature type.

Thanks.

Re: Block IP address

atticabank — Wed, 28 Nov 2012 13:55:42 GMT

Hello,

Thanks for the reply. What about if I don't know the ThreatIDs? Lets suppose that the attacker runs a vulnerability scanner. Is it possible for the 'Condition' option to configure something like 'any threatID'?

Kind regards

Re: Block IP address

rmonvon — Fri, 30 Nov 2012 19:11:15 GMT

The custom signature method requires a selection of threatIDs. For scanner detection, we can use DoS Protection to detect port scan, sweep, etc and block the source IP. Thanks.

Re: Block IP address

jshdpw — Thu, 21 Nov 2013 16:00:37 GMT

I agree with the original poster and the feature he is requesting. I'd like to be able to block the IP outright if it hits a certain threshold of threats without pre-determining which threats the attacker will hit (no way to know).

is this feature coming? when?