Page Comparison

Depending on your subscription level, each feed and Threat Insight policy in the Default Global Policy comes with a default action. 

...

Ensure that you understand the ramification of overriding the default action for any threat feeds and Threat Insight rules before doing so.

The following table lists the default actions and precedence for the feeds and Threat Insight in the Default Global Policy (to be supported until December 2024 and deprecated after December 2024):

...

• When configuring feed precedence order, the default Allow and default Block go on the top section, please remember to prioritize feeds configured with a Block action (Block - No Redirect, Block - Default Redirect, and/or Block - Redirect - <custom redirect name>) by placing them in positions of higher precedence in your policy compared to feeds configured with an Allow action (Allow - With Log, Allow - No Log, and/or Allow - Local Resolution). Within each of the Block and Allow section, place the high confidence feeds first, followed by medium confidence feeds and finally, the low confidences feed. Placing Blocked feeds higher in policy precedence order than Allowed feeds ensures that none of malicious domains are not allowed inadvertently, allowing security policy to perform as intended.
  
  
  

• Ensure that the precedence order assigned to the Security Policies are properly configured.
• Make sure that Geolocation option is enabled in Security Policy to ensure that the ECS supported domains should get DNS response accordingly from the authoritative nameservers. For more information, see Best Practices for Data Connector. 
• Ensure that the precedence order assigned to the Security Policies are properly configured.

...