Skip to content

Firewall integration

Firewall integration blocks addresses based on Intrudect alerts. Rules turn matching alerts into a block list of IP addresses; the firewall pulls the list over HTTPS and drops traffic to and from the listed addresses. Intrudect never connects to the firewall.

network agent ── alert ──► rules ──► block list ◄── firewall pulls (1–5 min)
                              ▲
                         exclusions

Rules

A rule defines:

  • Alert types — optionally narrowed by minimum severity, agents and subject filter. One filter per line: plain text matches the alert subject, SID 2024217 matches a signature.
  • Scope — networks from Site > Networks, All networks, IPs/CIDRs and/or Public IPs. Addresses outside the scope are never blocked by the rule.
  • Threshold — matching alerts from the same address within N minutes (default 1 alert).
  • Duration — 1 h, 4 h, 24 h, 7 days, 30 days or until manually cleared. A new matching alert restarts the timer.

Blocked address per alert type:

Blocks Alert types
Source Portscan, discovery, honeypot, password brute-force, SMB, LDAP, admin protocol, inter-network, new device, virtual jail, user agents, DNS (querying client)
Destination DNS unauthorized server
Outside party (source if both or neither side is internal) IOC, TOR, signature
Not blockable ARP, DHCP, new service, service down, agent health, egress

Internal = inside a defined network or a private address range.

  • Alerts dropped by a suppression rule or an agent-side exclusion do not trigger rules.
  • An address has at most one block. With several matching rules the later expiry wins; until manually cleared wins over any expiry.
  • Changing, disabling or deleting a rule does not release existing blocks.
  • New device rules require Alert for new devices on the network in Site > Networks.

Warning

Blocks are per IP address. An internal address blocked until manually cleared stays blocked after DHCP assigns it to another device. Use timed blocks on DHCP networks.

Exclusions

An IP, CIDR or network that is never blocked, with optional expiry. Applies to all rules or to selected rules only (e.g. a vulnerability scanner may portscan, but is still blocked when it contacts an IOC address).

  • Saving an exclusion releases the active blocks it covers.
  • Exclusions for all rules also apply to blocks created through the API.
  • There are no built-in exclusions.

Active blocks and History

Active blocks lists blocked addresses with rule, hits and expiry. Release removes an address from the list, optionally adding an exclusion. History keeps expired and released blocks as long as network alerts are kept.

Feed

Settings

Setting Description
Enable module Off: rules are not evaluated, the feed returns 404.
Alert if a firewall has not pulled the list in 1 hour Raises one Agent health alert "Firewall stopped pulling block list" per firewall.
Allowed source IPs Optional IPs/CIDRs allowed to pull. Others get 403. A cloud-hosted web UI sees the firewall's public (NAT) address.

Note

Behind a reverse proxy set REALIPHEADER / TRUSTEDPROXIES in config.json, otherwise every firewall appears as the proxy address.

Feed address

https://<HOMEURL>/fw/feed/<token>
  • Rotate token invalidates the old address immediately.
  • Format: plain text, one IPv4/IPv6 address per line, sorted, with ETag.

Notifications

Integrations with the Firewall blocks type (Settings > Integrations) receive new blocks and releases.

Connecting a firewall

  • FortiGate
  • MikroTik (RouterOS 7)
  • Other firewalls: any firewall that accepts a plain-text IP list URL (Palo Alto EDL, OPNsense/pfSense URL table alias, Check Point, Cisco FTD, …). Use the list as source and destination in deny rules.