Safe List
Use the Deception > Safe List page to add an IP address that is considered legitimate so that it does not generate an Event or Incident when accessing decoys. For example, the IP address of a monitoring system that is polling the network.
The Safe list page displays the following information:
|
Name |
The safe list name. |
|
IP/Mask |
Specify the IP address or subnet from where the connection originate. |
|
Source Ports |
Specify the source ports from where the connection originates. |
|
Destination Ports |
Specify the destination ports on the network where the connection terminates. |
|
Description |
Specify a description. For example, you can name it as Safe_Network. |
|
Services |
Select the name of the services used to connect to the network. |
|
Appliance |
This column indicates the source of the safelist, either local (manager) or remote (remote appliance). It is only visible when the manager operates in Central Management mode. |
|
Status |
Select Enabled or Disabled. |
To add a new Safe List IP address:
- Go to Deception > Safe List.
- Click Add New Safe List IP
- Coinfigure the safe list settings and click OK.
Name
Enter a description of the list. For example, Safe_Network.
IP/Mask
Enter the IP address or subnet from where the connection originates.
Source Ports
Enter the source ports from where the connection originates.
Destination Ports
Enter the destination ports on the network where the connection terminates.
Services
Select the name of the services used to connect to the network.
Appliance
Select an appliance from the list.
Decoy
Select the decoy name for you want to apply the safe list rule.
Enable
Select Enabled or Disabled.