Blocking
Blocked Requests
The Blocked Requests page lists the requests that were blocked and relevant data about when and where the attack occurred that caused the threat to be blocked.
| The Request ID is a random string generated to help identify every request that passes through your ThreatX sensors. This request ID is visible on every allowed request in the response header, and also is presented in the 403 message of every blocked request. |
Request IDs are useful for investigating issues or blocked requests, and can be given to the ThreatX SOC if more assistance is needed. ThreatX SOC retains the logs of all suspicious and malicious requests for 90 days, and IDs for those requests remain searchable during that time.
Click View Entity to be taken to that entity’s Entity Details page, where you see the full details of the request that was blocked.
Managing listed IP addresses
Lists are used to block, deny, or allow IP addresses.
| List | Entries |
|---|---|
Block List |
Temporary (automatic removal) |
Black List |
Permanent (manual removal) |
White List |
Permanet (manual removal) |
The lists are often managed by your analysts and, therefore, the procedures to manage the lists are provided in the ThreatX Managed API and Application Protection Platform Analyst Guide.