| Parameter | Type | Description |
|---|---|---|
| Action | String | Filter by detected network anomalies or blocked network attacks. |
| Blocked | Boolean | Filter by whether a potential network attack was blocked or not. The following values are available:
|
| Host | String | Filter by a specific host on which a network anomaly was detected, or exclude it from the results. All available hosts are shown. |
| Continent | String | Filter by a specific continent from which a potential network attack was carried out, or exclude it from the results. All available continents are shown. |
| Country | String | Filter by a specific country from which a potential network attack was carried out, or exclude it from the results. All available countries are shown. |
| Source IP | String | Filter by a specific IP address from which a potential network attack was carried out, or exclude it from the results. All available source IP addresses are shown. |
| Severity | String | Filter by a network anomaly with a specific severity or exclude it from the results. All available severity levels are shown. |
| Type | String | Filter by a specific type of network anomaly or exclude it from the results. All available network anomaly types are shown. |
| Column | Description |
|---|---|
| Severity | Shows the severity of the detected network anomaly. The following severity levels can be shown:
The severity is grayed out if the network anomaly has already been blocked automatically or manually. |
| Action | Shows the status of the network anomaly. The following states can be shown:
|
| Type | Shows the type of network attack. For more information on which types of network attacks can be shown here, see our Knowledge Base: What types of network attacks does the Enginsight IDS detect? |
| Source | Shows the IP address and country from which the network attack was carried out. :computer-mouse: Click the Filter icon :filter: next to a source to filter the list directly by that source. |
| Target | Shows the IP address and name of the host targeted by the network attack. :computer-mouse: Click a host name to navigate to the corresponding host detail view. |
| Detected at | Shows the date and time when the network anomaly was detected. |
| Actions | Create a manual Shield rule for the detected network anomaly. :computer-mouse: Click Address Anomaly. A new window opens where you can create a manual rule directly. |
| Details | Show an excerpt from the IDS log with more detailed information about the detected network anomaly. This can include, for example, the HTTP method used or the SID, which is the numerical ID of the rule that detected the network anomaly. :computer-mouse: Click Details to show the log excerpt in a new window.  |
| Option | Description |
|---|---|
| Name | Enter a meaningful name for the rule or keep the predefined name. The default name follows this structure: Quick [predefined action] [source IP address]. |
| Action | Define an action that should be enforced for the network connection that triggered the network anomaly. The default action is Drop. :computer-mouse: Click the Action field to expand a list of all available actions. The following actions are available:
Please note: Rules that allow network connections always override all rules that drop or reject the respective connections! To defend against network attacks, we always recommend that you use the Drop action. This prevents attackers from receiving information about the use of security software. |
| Protocols | Define one or more transport protocols that further specify the network connection to which the action should apply. The default protocols setting is All Protocols. :computer-mouse: Click the Protocols field to expand a list of all available protocols. Select one protocol, multiple protocols, or the All Protocols option. |
| Option | Description |
|---|---|
| Action | Define whether you want to specify the source using a subnet or a domain name. The default action is CIDR. :computer-mouse: Click the Action field to expand a list of all available options.
|
| CIDR | :eye: This option is only visible if you selected CIDR in the Action field. This field is already prefilled with the CIDR of the subnet of the selected list item. Enter a subnet in Classless Inter-Domain Routing (CIDR) notation. |
| FQDN | :eye: This option is only visible if you selected FQDN in the Action field. Enter a fully qualified domain name (FQDN), including all subdomains, for example hostname.in.domain. |
| Delete | :computer-mouse: Click the Delete icon :trash: to remove your entries. |
| Option | Description |
|---|---|
| Host Binding | Define whether you want to assign hosts to the rule by name or by tags. The default host binding is Reference. :computer-mouse: Click the Host Binding field to expand a list of all available options.
|
| Hosts | :eye: This option is only visible if you selected Reference in the Host Binding field. Define hosts that should be added to the rule. This field is already prefilled with the host of the selected list item. :computer-mouse: Click the Hosts field to expand a list of all available hosts and select one or more hosts. You can also use the free-text input to find hosts in the list more quickly. :computer-mouse: Click the Remove icon :circle-xmark: next to an added host to remove it from the Hosts field. |
| Tags | :eye: This option is only visible if you selected Tags in the Host Binding field. Define tags for groups of hosts that should be added to the rule. :computer-mouse: Click the Tags field to expand a list of all available tags and select one or more tags. You can also use the free-text input to find tags in the list more quickly. :computer-mouse: Click the Remove icon :circle-xmark: next to an added tag to remove it from the Tags field. |