...
- From the Data Management tab, select the Threat Analytics tab -> Whitelist tab.
- The appliance displays the following for each trusted domain:
- Actions: Click the action Action icon
(shown as a gear in each row) next to a domain and select one of the following:- Disable: Click this to disable the domain. When you disable a domain, the appliance does not treat this domain as trusted domain until you enable it.
- Edit: Click this to open the Whitelist editor. For system domains, the only property you can modify is to disable or enable them. For custom domains however, you can also add information to the Comment field.
- Delete: This is only applicable to custom domains. You cannot delete system domains. Select this to delete the custom domain.
- Domain Name: The name of the trusted domain.
- Type: Displays the domain type. This can be System or Custom. A system domain is a trusted domain that carries legitimate DNS tunneling traffic such as Avast, Sophos, McAfee, Boingo, Barracuda, and others. A custom domain is one that you have added to the whitelist or moved from the mitigation blacklist RPZ.
- Disabled: Indicates whether this domain is disabled or not. The appliance does not treat disabled domains as trusted domains. You can disable both system and custom domains.
- Comment: Additional information about the domain.
- Actions: Click the action Action icon
...
- If you want to move a blacklisted domain to the analytics whitelist so it becomes a trusted domain, select the domain check box and click the action Action icon (shown as a gear in each row) next to the domain, and then select Move to Whitelist.
- Navigate to the next or last page of the whitelist using the paging buttons at the bottom of the panel.
- Refresh the blacklist feed by clicking the Refresh button.
- Use filters and the Go to function to narrow down the list. With the autocomplete feature, you can just enter the first few characters of an object name in the Goto field and select the object from the possible matches.
- Select a quick filter to search for specific entries.
- Print the blacklist or export it in CSV format.
...
- From the Data Management tab, select the Data Management tab -> DNS tab -> Response Policy Zones tab.
- Select a blacklisted domain and click the action Action icon (shown as a gear in each row) next to a domain and select Move to Whitelist.
...