Threat Prevention - Revision history

Græmer: /* Advanced */

2023-04-04T18:47:45Z

Advanced

← Older revision		Revision as of 18:47, 4 April 2023
Line 141:		Line 141:

	'''Custom block page URL:''' Set an external location where to redirect users when they are denied access to a web site by Threat Prevention. This is useful if you want to use your own server to process the denial in a different way than the built-in denial options.		'''Custom block page URL:''' Set an external location where to redirect users when they are denied access to a web site by Threat Prevention. This is useful if you want to use your own server to process the denial in a different way than the built-in denial options.

			Enabling this option will only redirect internal/outbound traffic to your custom page. It will not function to redirect external/inbound traffic (such as Port Forwarded traffic).

	'''Block Options:'''		'''Block Options:'''

Bcarmichael: /* Rules */

2022-08-04T15:23:00Z

Rules

← Older revision		Revision as of 15:23, 4 August 2022
Line 77:		Line 77:
	In addition to all the common rule types, there are four that are unique to Threat Prevention, and these can be useful for making exceptions to the general Reputation Threshold setting.		In addition to all the common rule types, there are four that are unique to Threat Prevention, and these can be useful for making exceptions to the general Reputation Threshold setting.

	'''~~Source~~ address reputation ~~threshold~~'''		'''Client address reputation'''
	The reputation value of a source IP address returned by the Webroot BrightCloud® service. This applies to incoming connections from the Internet to open services on your network.		The reputation value of a source IP address returned by the Webroot BrightCloud® service. This applies to incoming connections from the Internet to open services on your network.

	'''~~Destination~~ address reputation ~~threshold~~'''		'''Server address reputation'''
	The reputation value of a destination IP address returned by the Webroot BrightCloud® service. This applies to outgoing connections to the Internet from hosts on your network.		The reputation value of a destination IP address returned by the Webroot BrightCloud® service. This applies to outgoing connections to the Internet from hosts on your network.

	'''~~Source~~ address category'''		'''Client address category'''
	The reputation category of a source IP address returned by the Webroot BrightCloud® service. This applies to incoming connections from the Internet to open services on your network.		The reputation category of a source IP address returned by the Webroot BrightCloud® service. This applies to incoming connections from the Internet to open services on your network.

	'''~~Destination~~ address category'''		'''Server address category'''
	The reputation category of a destination IP address returned by the Webroot BrightCloud® service. This applies to outgoing connections to the Internet from hosts on your network.		The reputation category of a destination IP address returned by the Webroot BrightCloud® service. This applies to outgoing connections to the Internet from hosts on your network.

Bcarmichael: /* Rules */

2022-08-04T15:17:19Z

Rules

← Older revision		Revision as of 15:17, 4 August 2022
Line 86:		Line 86:
	The reputation category of a source IP address returned by the Webroot BrightCloud® service. This applies to incoming connections from the Internet to open services on your network.		The reputation category of a source IP address returned by the Webroot BrightCloud® service. This applies to incoming connections from the Internet to open services on your network.

	'''Destination address ~~reputation threshold~~'''		'''Destination address category'''
	The reputation category of a destination IP address returned by the Webroot BrightCloud® service. This applies to outgoing connections to the Internet from hosts on your network.		The reputation category of a destination IP address returned by the Webroot BrightCloud® service. This applies to outgoing connections to the Internet from hosts on your network.

Græmer: /* Why is the client reputation score different from the Brightcloud Online Lookup tool? */

2022-05-03T18:42:01Z

Why is the client reputation score different from the Brightcloud Online Lookup tool?

← Older revision		Revision as of 18:42, 3 May 2022
Line 155:		Line 155:
	== Threat Prevention FAQs ==		== Threat Prevention FAQs ==

	=== Why is the client reputation score different from the [https://www.brightcloud.com/tools/url-ip-lookup.php ~~Brightcloud~~ Online Lookup tool?] ===		=== Why is the client reputation score different from the [https://www.brightcloud.com/tools/url-ip-lookup.php BrightCloud Online Lookup tool?] ===

	The Webroot ~~Brightcloud~~ lookup tool shows the server reputation score only. When using the Threat Prevention lookup tool within ~~Untangle~~, the result shows both the client and server reputation scores. The reputation applied to the session depends on the direction. For incoming sessions the client reputation is used. For outgoing sessions the server reputation is used.		The Webroot BrightCloud lookup tool shows the server reputation score only. When using the Threat Prevention lookup tool within NG Firewall, the result shows both the client and server reputation scores. The reputation applied to the session depends on the direction. For incoming sessions the client reputation is used. For outgoing sessions the server reputation is used.

Græmer: /* Rules */

2022-05-03T18:41:43Z

Rules

Bcarmichael at 23:24, 7 July 2021

2021-07-07T23:24:11Z

← Older revision		Revision as of 23:24, 7 July 2021
Line 152:		Line 152:

	{{:Threat Prevention Reports}}		{{:Threat Prevention Reports}}

			== Threat Prevention FAQs ==

			=== Why is the client reputation score different from the [https://www.brightcloud.com/tools/url-ip-lookup.php Brightcloud Online Lookup tool?] ===

			The Webroot Brightcloud lookup tool shows the server reputation score only. When using the Threat Prevention lookup tool within Untangle, the result shows both the client and server reputation scores. The reputation applied to the session depends on the direction. For incoming sessions the client reputation is used. For outgoing sessions the server reputation is used.

Bcarmichael: /* Advanced */

2020-10-14T01:36:43Z

Advanced

← Older revision		Revision as of 01:36, 14 October 2020
Line 142:		Line 142:
	'''Custom block page URL:''' Set an external location where to redirect users when they are denied access to a web site by Threat Prevention. This is useful if you want to use your own server to process the denial in a different way than the built-in denial options.		'''Custom block page URL:''' Set an external location where to redirect users when they are denied access to a web site by Threat Prevention. This is useful if you want to use your own server to process the denial in a different way than the built-in denial options.

	~~====~~ Block Options ~~====~~		'''Block Options:'''

	''Close connection for blocked HTTPS sessions without redirecting to block page'' If enabled, secure sites blocked by Threat Prevention do not redirect the user to a denial page and close the connection without any notice to the user. This is useful when you are not using [[SSL Inspector]] and the server's root certificate is not installed on the client device.		''Close connection for blocked HTTPS sessions without redirecting to block page'' If enabled, secure sites blocked by Threat Prevention do not redirect the user to a denial page and close the connection without any notice to the user. This is useful when you are not using [[SSL Inspector]] and the server's root certificate is not installed on the client device.

Bcarmichael: /* Advanced */

2020-10-14T01:34:43Z

Advanced

← Older revision		Revision as of 01:34, 14 October 2020
Line 136:		Line 136:
	\|}		\|}

	== Advanced ==		=== Advanced ===

			The Advanced section enables you to configure additional Threat Prevention options.

			'''Custom block page URL:''' Set an external location where to redirect users when they are denied access to a web site by Threat Prevention. This is useful if you want to use your own server to process the denial in a different way than the built-in denial options.

			==== Block Options ====

			''Close connection for blocked HTTPS sessions without redirecting to block page'' If enabled, secure sites blocked by Threat Prevention do not redirect the user to a denial page and close the connection without any notice to the user. This is useful when you are not using [[SSL Inspector]] and the server's root certificate is not installed on the client device.

			[[File:Apps threat-prevention advanced.png\|800px\|thumb\|center]]
			<div align="center">[[File:Play-circle.png\|link=http://demo.untangle.com/admin/index.do#apps/1/threat-prevention/advanced]]
			[http://demo.untangle.com/admin/index.do#apps/1/threat-prevention/advanced view on demo]</div>

	== Reports ==		== Reports ==

	{{:Threat Prevention Reports}}		{{:Threat Prevention Reports}}

Bcarmichael: /* Threat Results */

2020-10-14T01:26:24Z

Threat Results

← Older revision		Revision as of 01:26, 14 October 2020
Line 135:		Line 135:
	\|-		\|-
	\|}		\|}

			== Advanced ==

	== Reports ==		== Reports ==

	{{:Threat Prevention Reports}}		{{:Threat Prevention Reports}}

Bcarmichael: /* Threat Lookup */

2020-10-14T01:21:50Z

Threat Lookup

← Older revision		Revision as of 01:21, 14 October 2020
Line 104:		Line 104:
	Enter an IP Address or URL in the input field and click '''Search''' to get information.		Enter an IP Address or URL in the input field and click '''Search''' to get information.

	~~{{AppScreenshot~~\|threat-prevention\|lookup}}		[[File:Apps threat-prevention threat-lookup.png\|800px\|thumb\|center]]
			<div align="center">[[File:Play-circle.png\|link=http://demo.untangle.com/admin/index.do#apps/1/threat-prevention/lookup]]
			[http://demo.untangle.com/admin/index.do#apps/1/threat-prevention/lookup view on demo]</div>

	==== Threat Results ====		==== Threat Results ====

← Older revision		Revision as of 18:41, 3 May 2022
Line 71:		Line 71:
	=== Rules ===		=== Rules ===

	The '''Rules''' tab allows you to specify rules to Block, Pass or Flag traffic that crosses the ~~Untangle~~.		The '''Rules''' tab allows you to specify rules to Block, Pass or Flag traffic that crosses the NG Firewall.

	The [[Rules\|Rules documentation]] describes how rules work and how they are configured. Threat Prevention uses rules to determine to block/pass the specific session, and if the sessions is flagged. Flagging a session marks it in the logs for reviewing in the event logs or reports, but has no direct effect on the network traffic.		The [[Rules\|Rules documentation]] describes how rules work and how they are configured. Threat Prevention uses rules to determine to block/pass the specific session, and if the sessions is flagged. Flagging a session marks it in the logs for reviewing in the event logs or reports, but has no direct effect on the network traffic.
Line 78:		Line 78:

	'''Source address reputation threshold'''		'''Source address reputation threshold'''
	The reputation value of a source IP address returned by the Webroot ~~BrighCloud®~~ service. This applies to incoming connections from the Internet to open services on your network.		The reputation value of a source IP address returned by the Webroot BrightCloud® service. This applies to incoming connections from the Internet to open services on your network.

	'''Destination address reputation threshold'''		'''Destination address reputation threshold'''
	The reputation value of a destination IP address returned by the Webroot ~~BrighCloud®~~ service. This applies to outgoing connections to the Internet from hosts on your network.		The reputation value of a destination IP address returned by the Webroot BrightCloud® service. This applies to outgoing connections to the Internet from hosts on your network.

	'''Source address category'''		'''Source address category'''
	The reputation category of a source IP address returned by the Webroot ~~BrighCloud®~~ service. This applies to incoming connections from the Internet to open services on your network.		The reputation category of a source IP address returned by the Webroot BrightCloud® service. This applies to incoming connections from the Internet to open services on your network.

	'''Destination address reputation threshold'''		'''Destination address reputation threshold'''
	The reputation category of a destination IP address returned by the Webroot ~~BrighCloud®~~ service. This applies to outgoing connections to the Internet from hosts on your network.		The reputation category of a destination IP address returned by the Webroot BrightCloud® service. This applies to outgoing connections to the Internet from hosts on your network.

	==== Rule Actions ====		==== Rule Actions ====