Applies To: ThreatSync+ NDR
The All IP Addresses page in the ThreatSync+ UI shows details about internal and external IP addresses. You can use this page to view detailed information about IP address activity and device activity, to view associated Smart Alerts and policy alerts, and to perform block and unblock actions on specific external IP addresses.
This page is only available with a ThreatSync+ NDR license. For more information, go to About ThreatSync+ NDR Licenses.
IP addresses blocked by ThreatSync+ NDR do not appear on the Firebox Blocked Sites list in Fireware or WatchGuard Cloud.
If ThreatSync is enabled on your account, blocked IP addresses show on the Items Blocked by ThreatSync page. For more information, go to Manage Items Blocked by ThreatSync.
Before You Begin
Before you can view the All IP Addresses page, you must enable Firebox remediation on the Firebox page in the ThreatSync+ Integrations UI. With Firebox remediation enabled, you can manually and automatically block external IP addresses on Fireboxes in your account.
To enable Firebox remediation:
- Select Configure > ThreatSync+ Integrations > Firebox.
The Firebox page opens. - Select the Enable Remediation check box.
For more information, go to Configure Firebox Remediation.
All IP Addresses Page
To open the All IP Addresses page, from the ThreatSync+ UI:
- Select Monitor > ThreatSync+ > All IP Addresses.
The All IP Addresses page opens on the External tab and shows a list of IP addresses.
To filter the table, click the Block Status: All drop-down list and select Show Blocked or Show Not Blocked.
Manually Block or Unblock An External IP Address
When you block an external IP address, all Fireboxes in your account block connections to and from the IP address.
To block or unblock an external IP address:
- Select Monitor > ThreatSync+ > All IP Addresses.
The All IP Addresses page opens on the External tab and shows a list of IP addresses. - Next to the IP address you want to perform actions on, click Blocked or Not Blocked.
The Block Status column changes the status in the IP Addresses table.
You can block or unblock external IP addresses only.
To configure a ThreatSync+ NDR policy to automatically block external IP addresses that violate a policy, go to Configure ThreatSync+ Policies.
IP Addresses Details Page
To view details about a specific IP address, click an IP address to open the IP Address Details page.
The IP Address Details page shows information about the location, associated organization, and details on any Smart Alerts, policy alerts, behaviors, events, or traffic associated with the selected IP address.
For external IP addresses, the IP Address Details page also shows the remediation status of the IP address. Click Not Blocked or Blocked to block or unblock an IP address.