Page Comparison

To fully use this screen, you must add the following permission to your account:

• Read IP Threat Lookup Rule(s)

• Write IP Threat Lookup Rule(s)

• Write IP Threat Lookup Rule Never Expire IP

• Read IP Threat Lookup(s).

Before you create a rule, consider the following statements:

• When you add a rule, your rule may actually override Armor's default whitelist and blacklist policies. 

• You cannot use the same IP address in multiple rules, even if the rules are similar in action.

  • For example, if you create a rule to allow 1.1.1.1, then you cannot create a separate whitelist rule for 1.1.1.1/2.

• You cannot edit a rule.

  • If you want to edit a rule to a different list, then you must delete the rule, and then create a new rule.

• Although you can use this screen to research, create, and organize rules, you are responsible for implementing the actual rules in your environment.

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click IP Threat Lookup.

3. Click Rules.

4. Click the plus ( + ) icon.

5. Select Whitelist or Blacklist.

6. Enter an IP address or CIDR.

7. Select an expiration date. 

   • You will not receive a notification when a rule has expired; however, you can filter the Rules table to view expired rules. 

   • If your account contains the Write IP Threat Lookup Rule Never Expire IP permission, then as an option, you can mark Never Expire.  

8. Click Add Rule.

   • The newly created rule will appear in the Rules section.

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click IP Threat Lookup.

3. Click Rules.

4. Locate and hover over the desired rule.

5. Click the vertical ellipses.

6. Click Remove Rule.

7. Click Remove Rule again.

You can use the IP Lookup feature to review Armor’s recommendation regarding to allow or block an IP. Later, you can use this information to create an IP rule.

When you perform a search, you will receive two types of recommendations: 

• The Recommendation entry is based on Armor's default policy. 

• The Final Recommendation entry is based on any rules that you have previously created.

  • For example, if you created a rule to blacklist 123.444.555.777, and then you perform a search on 123.555.777.999, then the Final Recommendation will most likely say Block because of your previously created rule. 

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click IP Threat Lookup.

3. Click IP Lookup.

4. Enter an IP address, and then click Lookup.

   • The Recommendation entry is based on Armor's default policy. 

   • The Final Recommendation entry is based on any rules that you previously created.

5. (Optional) You can convert this IP lookup into an IP rule. Next to Rule Status, click the vertical ellipses, and then click Add Rule.  

6. Select Whitelist or Blacklist.

7. Select an expiration date. 

   • If your account contains the Write Iprm Rule(s) - Never Expire IP permission, then you can mark Never Expire.  

   • You will not receive a notification when a rule has expired; however, you can filter the Rules table to list expired rules. 

8. Click Add Rule.