There are seventeen threat categories to choose from on this screen. All IPs included in the
threat intelligence are placed in one or more of these categories.
Each category has an associated risk threshold slider which has a range of 1 to 100. Each IP in
the threat intelligence also has an associated score that can range from 1 to 100, with a higher
score representing a higher chance of it being malicious. Moving the sliders allows you to
control how strong of a policy you want to apply. A slider set at 90, the default, will block IPs in
that category with a score of 90 or higher. Moving the slider to the left, and decreasing the
threshold, will strengthen your policy by blocking more IPs with lower scores.
3.2.6 Exception Lists
You can edit the exceptions associated with a Resource Group by clicking the
Exception Lists
icon shown in the actions list.
To apply exceptions to a Resource Group, you first have to create the exception within your
Exception Lists
. The Exception Lists will not influence traffic until you add it to a Resource
Group.
Select one of your previously created Exception Lists, then select whether you want these
exceptions to be allowed or denied within the Resource Group.
Exceptions Lists override your country and threat intelligence policies. Even if a country is
blocked, you can still communicate with an internet address in that country if it is included in an
allowed Exception list. If you allow communications with a country, a particular internet address
within that country will be blocked if it is included in a denied Exception List.
Note that an address found in both an allowed and denied Exception List will be
allowed
.
3.2.9 Alerts
You can create an Alert to send an SNMP trap for excessive traffic by clicking the
Alerts
icon
from the actions list.
31
