Safe List

Use the Deception > Safe List page to add an IP address that is considered legitimate so that it does not generate an Event or Incident when accessing decoys. For example, the IP address of a monitoring system that is polling the network.

The Safe list page displays the following information:

Name	The safe list name.
IP/Mask	Specify the IP address or subnet from where the connection originate.
Source Ports	Specify the source ports from where the connection originates.
Destination Ports	Specify the destination ports on the network where the connection terminates.
Description	Specify a description. For example, you can name it as Safe_Network.
Services	Select the name of the services used to connect to the network.
Appliance	This column indicates the source of the safelist, either local (manager) or remote (remote appliance). It is only visible when the manager operates in Central Management mode.
Status	Select Enabled or Disabled.

To add a new Safe List IP address:

1. Go to Deception > Safe List.
2. Click Add New Safe List IP
3. Coinfigure the safe list settings and click OK.

   Name	Enter a description of the list. For example, Safe_Network.
   IP/Mask	Enter the IP address or subnet from where the connection originates.
   Source Ports	Enter the source ports from where the connection originates.
   Destination Ports	Enter the destination ports on the network where the connection terminates.
   Services	Select the name of the services used to connect to the network.
   Appliance	Select an appliance from the list.
   Decoy	Select the decoy name for you want to apply the safe list rule.
   Enable	Select Enabled or Disabled.