Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Note
titleAdvisory

For information on the recommended Rule Actions to be applied to feeds for the upcoming, August 22, 2023 feed changes, see the topic on Recommended Rule Actions After the August 2023 SURBL Feeds Deprecations. 

For each policy ruleRule actions define how traffic is handled based on policy rules, such as custom lists, feeds, feed and Threat Insight, and category and application filters. For each rule, you can define specify or override the action or override it as with one of the following options:

Rule Actions:

  1. Allow – With Log:
    Grants traffic access to a domain or IP address that hits a

...

  1. specific feed or security policy

...

  1. and logs the queries

...

  1. in all relevant reports.

  2. Allow – No Log:
    Grants traffic access to a domain or IP address that hits a

...

  1. specific feed or security policy, but does not log the queries

...

  1. in any reports.

  2. Allow

...

  1. Local Resolution:

...

    • Only available for application filters.

    • Allows web applications to bypass DNS and resolve locally on the

...

    • host.

...

  1. Block – No Redirect:
    Denies traffic access to a domain or

...

  1. IP address if it matches

...

  1. a

...

  1. specific feed.

  2. Block – Default Redirect:
    Routes traffic to the default Infoblox page or to a custom message

...

  1. configured for the Redirect Page.

  2. Block – Redirect – <custom redirect name>:
    Routes traffic to a destination based on the IP address or domain you have configured for the Redirect Page.

    • For information about

...

Depending on your subscription level, each feed and Threat Insight policy in the Default Global Policy comes with a default action. 

Note
titleNote
  • When configuring feed precedence order, Please remember to prioritize feeds configured with a Block action (Block - No Redirect, Block - Default Redirect, and/or Block - Redirect - <custom redirect name>) by placing them in positions of higher precedence in your policy compared to feeds configured with an Allow action (Allow - With Log, Allow - No Log, and/or Allow - Local Resolution).Placing Blocked feeds higher in policy precedence order than Allowed feeds ensures that your security policy performs as intended.
  • Ensure that you understand the ramification of overriding the default action for any threat feeds and Threat Insight rules before doing so.

The following table lists the default actions and precedence for the feeds and Threat Insight in the Default Global Policy:

...

Related Information:

For details on adding or removing feeds from a security policy, see the following topics: