Feed name crossed out in alerts.
-
Hey Everyone,
Looking for clarification on what exactly this is telling me.
See this on the alerts page.
I see this for connections that were allowed Aswell as ones that were blockedThanks,
-
I have come to find that it means the list is no longer being used. In DNSBL if i was to change from Adaway to Steven Black Ads. The old Adaway hits would have a line through them like you have.
-
@Uglybrian
In this example that's not the case.
The ET_Block list is still in use and continuing to block traffic as expected.Now if I download the list. I cannot find the IP or Range of IPs.
So maybe it is showing that this IP/range used to be on this list but based on the latest version it's not so falls under this new list instead?? -
The event that you see if saying that it was originally block via ET feed. Then later on its now being blocked via GeoIP feed.
When deduplication is enabled, it will remove all duplicates. And as feeds continue to be downloaded, IPs can change by cidr ranges as you see in this example. Also Aggregation can have an affect on CIDR ranges.
-
Thanks for the confirmation.
Another quick sanity check.
The event that i screenshot was a permit event.
The ET_Block list is associated with a deny rule.De-duplication won't affect permit rules correct?
Deny rule is configured as Alias Deny
Permit rule uses geo IP and is set to Alias Permit. -
@Zaketis dedup is only Deny Feeds which would also include and GeoIP lists. Aggregation works in separate silos for each type ie: permit or deny etc...
