Introduction

Denied Lists can be used to ensure that untrusted IPs and Domains are blocked by the ThreatBlockr appliance.

When a denied list is enabled from Denied Lists > IPv4, the list is enabled by default for any policies which inherit default lists.

When a denied list is enabled from Denied Lists > Domain, the list is enabled globally for all policies.

Out-of-the-box denied lists provided by Bandura Cyber are refreshed in 60 minute intervals.

Denied Lists

To create an IPv4 Denied List:

Navigate to Denied Lists > IPv4 in the left hand menu:
https://gmc.banduracyber.com/denied-lists/ipv4.
Click on the green '+' button in the top right corner.
Click on the Type dropdown to select the type of list you want to create.
- Manual: IPv4 address list with manually added IPs (e.g. IP addresses for internal web services)
- Plugins: IPv4 address lists automatically pulled from the service provider. See Default Lists Descriptions.
Enter a unique name in the Name field, and optionally, provide a description for the list.
If using a Plugin-type IPv4 List:
- Enter an Interval - how often the IP list should be refreshed for that plugin.
- Complete any required Configurations (e.g. providing credentials, selecting feed names, etc.).
Click Create to create and save the list.
- Automatic lists from plugins can 15-30 minutes to populate initially.

To add an IPv4 address to an IPv4 Denied List:

Click on the Denied List name or on the magnifying glass in the related row to View IPv4 Allowed List.
Click on the green '+' button in the top right corner.
Enter the following:
- IPv4 address: the IP to be denied.
- Maskbits: CIDR notation, 0-32
- (Optional) Description: description of this IP address (e.g. Hafnium hack IP address).
- (Optional) Expires: choose if the IPv4 address should or should not expire and be removed from the list on a certain date/time.
Click Create to create and save the IPv4 address to the list.

To create a Domain Denied List:

Navigate to Denied Lists > Domain in the left hand menu:
https://gmc.banduracyber.com/denied-lists/domain.
Click on the green '+' button in the top right corner.
Click on the Type dropdown to select the type of list you want to create.
- Manual: Domain address list with manually added domains
- Plugins: Domain address lists automatically pulled from the service provider. See Default Lists Descriptions.
Enter a unique name in the Name field, and optionally, provide a description for the list.
If using a Plugin-type Domain List:
- Enter an Interval - how often the IP list should be refreshed for that plugin.
- Complete any required Configurations (e.g. providing credentials, selecting Service Areas, etc.).
Click Create to create and save the list.
- Automatic lists from plugins can 15-30 minutes to populate initially.

To add a Domain to an Domain Denied List:

Click on the Denied List name or on the magnifying glass in the related row to View Domain Allowed List.
Click on the green '+' button in the top right corner.
Enter the following:
- Domain: the domain to be denied.
- (Optional) Expires: choose if the domain should or should not expire and be removed from the list on a certain date/time.
Click Create to create and save the Domain address to the list.