Threats

The Instant On secure gateway provides an Intrusion Detection and Prevention System (IDPS) for real-time threat detection and protection. IDPS continuously analyzes network traffic to identify suspicious activities or potential attacks. It helps protect the network from cyber threats, including malware communication and intrusion attempts.

Threat detection and prevention are enabled by default.

Threats

The Security > Threats section displays the list of threats detected on the site. Threats with a critical severity level are reported in the Threats table and blocked. The threats with other severity levels are reported in the Threats table but are not blocked. You have the option to add an exception to the threat to change the default action taken.

The Threats table displays the following information:

Table 1: Threats List

Field	Description
Threat	Name of the Threat identifier.
State	Denotes the current state of the threat whether it is blocked or allowed.
Occurred	Indicates when the threat was detected in the time zone of the site.
Category	Denotes the general category or classification of the threat.
Severity	Denotes the severity of the generated threat. The severity levels are categorized as follows: Critical—Refers to vulnerabilities that can cause significant disruptions, system failure, or data loss. Major—Refers to high-risk threats that could impact the system or data. Minor—Refers to low-risk threats that usually do not require immediate action. Info—The alert is for reference only and has little to no impact on the system. Undefined—The system could not determine the threat's severity.
Source	Denotes the source host or origin of the threat.
Destination	Denotes the destination host of the threat.

Threat Details

Selecting a threat opens a panel that displays complete information about the threat. When an exception has been applied to the threat, a banner at the top of the panel indicates whether the threat is blocked or allowed by the exception and the date it was applied, and provides a View Exception link to the corresponding threat exception.

Along with the Threat name, Severity, State, and Occurred information also shown in the Threats table, the panel provides the following details.

Table 2: Signature

Field	Description
Category	The general category of the threat.
Type	A more specific classification of the threat within its category. Displayed only when available.
Malware Family	The malware family associated with the threat. Displayed only when available.
CVE	The Common Vulnerabilities and Exposures (CVE) identifier associated with the threat. Displayed only when available.

Table 3: Details

Field	Description
Protocol	The network protocol used by the threat.
Source	The source host of the threat. When the source matches a known client or device on the site, its name is displayed with a link to that entity; otherwise, the IP address is displayed.
Source Port	The source port used by the threat. Displayed only when available.
Destination	The destination host of the threat. When the destination matches a known client or device on the site, its name is displayed with a link to that entity; otherwise, the IP address is displayed.
Destination Port	The destination port used by the threat. Displayed only when available.

Whenever possible, the panel also provides the Probable Causes, the likely reasons the threat was detected, and the Recommended Actions, the suggested steps to take to address it.

Threat Actions

The actions available for a threat depend on its current state and on whether an exception has already been applied. To manage the action taken on a threat:

1. Under Security > Threats, hover over the threat and select the actions menu (the ellipsis icon).
2. Select one of the following:
   • Add Block Exception—Available for a threat that is currently allowed. Adds a block exception so that the threat is blocked. A confirmation message indicates that the threat has been blocked.
   • Add Allow Exception—Available for a threat that is currently blocked. Adds an allow exception so that the threat is allowed. A confirmation message indicates that the threat has been allowed.
   • View Exception—Available when an exception has already been applied to the threat, in which case it is the only available action. Selecting it opens the Threat Exceptions page, selects the corresponding exception, and opens its details panel.
3. To remove an exception and restore the default action for a threat, use the Threat Exceptions page.