topic Time-out Rule in General Topics

Time-out Rule

DPoppleton — Thu, 12 Jan 2017 14:24:57 GMT

We get a bunch of threat alerts from a single source IP from time to time, like someone running a script on or scanning a specific host for vulnerabilities. Some traffic is allowed through to the host. Does anyone know of a way to put an IP in a time-out when they appear to be doing something like this?

My thought would be if a host on the internet generates so many threat alerts in a given time frame all traffic from that IP is then blocked for 10 minutes or so. Is this possible?

Re: Time-out Rule

reaper — Thu, 12 Jan 2017 14:33:48 GMT

you can configure timed blocking in several spots

you can enable zone protection reconnaissance protection and block IP addresses for a duration, create vulnerability protection profiles with the action set to block for a duration or configure individual threat signatures to enforce a timed block:

Re: Time-out Rule

DPoppleton — Thu, 12 Jan 2017 14:52:42 GMT

If my action on a critical threat is to reset-both, can I have this block IP action in parallel?

Re: Time-out Rule

reaper — Thu, 12 Jan 2017 15:23:38 GMT

unfortunately no, you can only apply one action at a time