> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/shield.md).
# Shield
Shield is Enginsight's Intrusion Prevention System (IPS). The Shield feature allows you to individually block network traffic and network attacks detected by the [Enginsight Intrusion Detection System (IDS)](/docs/manual/english/platform-usage/hosts/intrusion-detection-system.md) on all [hosts](/docs/manual/english/platform-usage/hosts.md) on which a [Pulsar is installed](/docs/manual/english/installation-and-configuration/installation-and-configuration/enginsight-components/pulsar.md).
To prevent attacks on your network, you can create automatic rules ([Autopilots](/docs/manual/english/platform-usage/shield/dynamic-blocking/autopilot.md)) that dynamically block detected network attacks, [manual rules](/docs/manual/english/platform-usage/shield/manual-blocking/manual-rules.md) for specific connections on specific hosts, or [microsegments](/docs/manual/english/platform-usage/shield/microsegmentation/microsegments.md) that are completely isolated from the rest of the network except for explicitly permitted connections.
Shield provides a [level-based blocking system](/docs/manual/english/platform-usage/shield/dynamic-blocking/autopilot/add-autopilot.md#blocking-level-of-intrusion-prevention-system) with five levels, which allows you to configure an individual balance between performance and security.
***
## Requirements
**Enabling the Shield Feature**
* For Shield rules to take effect, you must enable the **Enginsight Shield (IPS)** option in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md#core-feature) or under **Hosts** → **Policy Manager** via a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#enginsight-shield-ips).
**Using the Shield Feature on a Linux Host**
* We recommend that you use Linux kernel version 4.19 or later when using Shield.
***
## Important Notes
**Using the Shield Feature With the Enginsight On-Premises Version**
* We recommend that you introduce Shield rules in several stages and monitor the Application Server's available performance capacity. Depending on the number of network anomalies detected and blocked, Shield can significantly increase the Application Server's CPU and memory usage.
**Using the Shield Feature With a Virtual Private Network (VPN)**
* When using a VPN, we recommend that you create a Shield rule that permits communication with both the public and VPN-internal IP address of the VPN gateway. This rule should be assigned to all hosts that access the Enginsight API via VPN by default. This prevents communication between Pulsar and the Enginsight API from being interrupted because microsegmentation or manual Shield rules unintentionally block the connection to the VPN server.
**Using the Shield Feature With a Reverse Proxy**
* If you use Autopilot to automatically block detected network attacks on a server with or behind a reverse proxy, note that instead of the reverse proxy's IP address as the source IP address, the IP address transmitted in one of the following HTTP headers is blocked:
* Forwarded
* X-Forwarded-For
* X-ProxyUser-Ip
* Client-Ip
* ClientIp
* UserIp
* X-Client-Ip
* X-Real-Ip
* X-Remote-Addr
* Automatic blocking via Autopilot only works correctly with a reverse proxy if the correct service has also been detected or selected for the service or services behind the reverse proxy. This may be necessary in particular if you do not use the default ports for specific services, for example, a port other than 443 for HTTPS. In this case, you must manually add the service used under [Connections](/docs/manual/english/platform-usage/host-detail-view/monitoring/connections.md) on the reverse proxy server.
**Information About Shield Rules**
* Shield rules that permit network connections always override rules that drop or block the corresponding connections.
* We always recommend that you use the **Drop** action to defend against network attacks. This prevents attackers from receiving information indicating that security software is in use.
**Information About Microsegments**
* A microsegment blocks ***all*** network connections, regardless of whether they are internal or external. This initially also prevents ordinary outbound connections, such as retrieving and installing updates via HTTPS. Communication is possible only through the defined [microsegment rules](/docs/manual/english/platform-usage/shield/microsegmentation/rules.md).
* If Docker containers are running on a host or within an IP address range in the microsegment, you should ***not*** include their subnets when isolating the microsegment. Doing so would also prevent communication between the Docker containers. This is because Pulsar, which is installed on the host, only knows the gateway IP address of the Docker network interface, not the IP addresses of the individual containers.
***
## Shield: Menu Structure
:computer-mouse: Click the **Shield** icon  in the sidebar to open the **Shield** menu.
{% hint style="info" %}
**Please note:** The order of the main menu items can be customized using drag and drop. Your menu may therefore appear in a different order than shown here.
{% endhint %}
The **Shield** menu is structured as follows:
{% columns %}
{% column width="33.33333333333333%" %}
{% endcolumn %}
{% column width="66.66666666666667%" %}
* [Logs](/docs/manual/english/platform-usage/shield/logs.md): Here you can find an overview of all network connections for which a Shield rule has taken effect.
* [Microsegmentation](/docs/manual/english/platform-usage/shield/microsegmentation.md):
* [Microsegments](/docs/manual/english/platform-usage/shield/microsegmentation/microsegments.md): Here you can divide your network into smaller, isolated, host-based segments.
* [Rules](/docs/manual/english/platform-usage/shield/microsegmentation/rules.md): Here you can define the connections through which microsegments are permitted to communicate.
* [Manual Blocking](/docs/manual/english/platform-usage/shield/manual-blocking.md):
* [Manual Rules](/docs/manual/english/platform-usage/shield/manual-blocking/manual-rules.md): Here you can manually permit, drop, or block specific network connections on specific hosts.
* [Mappings](/docs/manual/english/platform-usage/shield/manual-blocking/mappings.md): Here you can assign specific hosts or groups of hosts to manual rules.
* [Dynamic Blocking](/docs/manual/english/platform-usage/shield/dynamic-blocking.md):
* [Autopilot](/docs/manual/english/platform-usage/shield/dynamic-blocking/autopilot.md): Here you can create rules that automatically block attacks on your network.
* Required Services:
* [Hosts](/docs/manual/english/platform-usage/hosts.md)
{% endcolumn %}
{% endcolumns %}
***
