Time-out Rule

[DPoppleton]

We get a bunch of threat alerts from a single source IP from time to time, like someone running a script on or scanning a specific host for vulnerabilities. Some traffic is allowed through to the host. Does anyone know of a way to put an IP in a time-out when they appear to be doing something like this?

My thought would be if a host on the internet generates so many threat alerts in a given time frame all traffic from that IP is then blocked for 10 minutes or so. Is this possible?

[reaper · Accepted solution]

you can configure timed blocking in several spots

you can enable zone protection reconnaissance protection and block IP addresses for a duration, create vulnerability protection profiles with the action set to block for a duration or configure individual threat signatures to enforce a timed block:

[DPoppleton]

If my action on a critical threat is to reset-both, can I have this block IP action in parallel? 

[reaper]

unfortunately no, you can only apply one action at a time