Time-out Rule

cancel
Showing results for 
Search instead for 
Did you mean: 

Time-out Rule

L3 Networker

We get a bunch of threat alerts from a single source IP from time to time, like someone running a script on or scanning a specific host for vulnerabilities. Some traffic is allowed through to the host. Does anyone know of a way to put an IP in a time-out when they appear to be doing something like this?

 

My thought would be if a host on the internet generates so many threat alerts in a given time frame all traffic from that IP is then blocked for 10 minutes or so. Is this possible?

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

you can configure timed blocking in several spots

 

you can enable zone protection reconnaissance protection and block IP addresses for a duration, create vulnerability protection profiles with the action set to block for a duration or configure individual threat signatures to enforce a timed block:

zone protectionvulnerability policyindividual threat signature

Tom Piens
PANgurus

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

you can configure timed blocking in several spots

 

you can enable zone protection reconnaissance protection and block IP addresses for a duration, create vulnerability protection profiles with the action set to block for a duration or configure individual threat signatures to enforce a timed block:

zone protectionvulnerability policyindividual threat signature

Tom Piens
PANgurus

View solution in original post

If my action on a critical threat is to reset-both, can I have this block IP action in parallel? 

unfortunately no, you can only apply one action at a time

Tom Piens
PANgurus
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!