Block IP address

[atticabank]

Hello,

Is there a way to block a specific IP address if you detect multiple threats coming from this IP? For example block an IP address after the detection of 5 threats coming from this IP within 1 minute.

I know you can block an IP  but only as an action after the detection of a specific threat.

Kind regards

[rmonvon · Accepted solution]

Yes, you can block a source IP or combo source/dest pair for a time period using custom signatures.  Here's an example to block the source IP for threat 10353.  Make sure to select 'Combination' for signature type.

Thanks.

[atticabank]

Hello,

Thanks for the reply. What about if I don't know the ThreatIDs? Lets suppose that the attacker runs a vulnerability scanner. Is it possible for the 'Condition' option to configure something like 'any threatID'?

Kind regards

[rmonvon]

The custom signature method requires a selection of threatIDs.  For scanner detection, we can use DoS Protection to detect port scan, sweep, etc and block the source IP.  Thanks.

[jshdpw]

I agree with the original poster and the feature he is requesting.  I'd like to be able to block the IP outright if it hits a certain threshold of threats without pre-determining which threats the attacker will hit (no way to know).

is this feature coming? when?