Introduction

Denied Lists can be used to ensure that untrusted IPs and Domains are blocked by the ThreatBlockr appliance.

When a denied list is enabled from Denied Lists > IPv4, the list is enabled by default for any policies which inherit default lists. 

When a denied list is enabled from Denied Lists > Domain, the list is enabled globally for all policies.

Out-of-the-box denied lists provided by Bandura Cyber are refreshed in 60 minute intervals.

Denied Lists

IPv4

To create an IPv4 Denied List:

• Navigate to Denied Lists > IPv4 in the left hand menu:
  https://gmc.banduracyber.com/denied-lists/ipv4. 
• Click on the green '+' button in the top right corner.
• Click on the Type dropdown to select the type of list you want to create.
  
  • Manual: IPv4 address list with manually added IPs (e.g. IP addresses for internal web services)
  • Plugins: IPv4 address lists automatically pulled from the service provider. See Default Lists Descriptions.
• Enter a unique name in the Name field, and optionally, provide a description for the list.
• If using a Plugin-type IPv4 List:
  • Enter an Interval - how often the IP list should be refreshed for that plugin.
  • Complete any required Configurations (e.g. providing credentials, selecting feed names, etc.).
• Click Create to create and save the list. 
  • Automatic lists from plugins can 15-30 minutes to populate initially.

Adding Entries to IPv4 Denied Lists

To add an IPv4 address to an IPv4 Denied List:

• Click on the Denied List name or on the magnifying glass in the related row to View IPv4 Allowed List.
• Click on the green '+' button in the top right corner.
• Enter the following:
  • IPv4 address: the IP to be denied.
  • Maskbits: CIDR notation, 0-32
  • (Optional) Description: description of this IP address (e.g. Hafnium hack IP address).
  • (Optional) Expires: choose if the IPv4 address should or should not expire and be removed from the list on a certain date/time.
• Click Create to create and save the IPv4 address to the list.

Domain

To create a Domain Denied List:

• Navigate to Denied Lists > Domain in the left hand menu:
  https://gmc.banduracyber.com/denied-lists/domain. 
• Click on the green '+' button in the top right corner.
• Click on the Type dropdown to select the type of list you want to create.
  
  • Manual: Domain address list with manually added domains
  • Plugins: Domain address lists automatically pulled from the service provider. See Default Lists Descriptions.
• Enter a unique name in the Name field, and optionally, provide a description for the list.
• If using a Plugin-type Domain List:
  • Enter an Interval - how often the IP list should be refreshed for that plugin.
  • Complete any required Configurations (e.g. providing credentials, selecting Service Areas, etc.).
• Click Create to create and save the list. 
  • Automatic lists from plugins can 15-30 minutes to populate initially.

Adding Entries to Domain Denied Lists

To add a Domain to an Domain Denied List:

• Click on the Denied List name or on the magnifying glass in the related row to View Domain Allowed List.
• Click on the green '+' button in the top right corner.
• Enter the following:
  • Domain: the domain to be denied.
  • (Optional) Expires: choose if the domain should or should not expire and be removed from the list on a certain date/time.
• Click Create to create and save the Domain address to the list.

Related Articles

• How Does Domain Blocking Work with Allowed and Denied Lists?
• Configuring Policies
• Policy Best Practices
• Default Lists Descriptions