close
keyboard_arrow_left
Table of Contents
- play_arrow Introduction to Installing Network Insights
- play_arrow Network Insights Overview
- play_arrow Network Insights Use Cases
- play_arrow Flow Inspection Levels
- play_arrow Network Flow Data
- play_arrow Supported Inspectors
list Table of Contents
Direct Lookups for IP Reputation Classifications
date_range
12-May-22
To ensure that your IP reputation classifications are using the most recent classification information that is available, create rules and queries that use direct X-Force IP reputation lookups.
You can use the following X-Force IP categorizations:
Anonymization Services
Botnet Command and Control Server
Bots
Cryptocurrency Mining
Dynamic IPs
Malware
Scanning IPs
Spam
For example, a rule that uses the Anonymization Services categorization might use the following building block:
content_copy zoom_out_map
when Destination IP is categorized by X-Force as Anonymization Services with confidence value greater than 50
In Ariel Query Language (AQL), you can use the XFORCE_IP_CATEGORY function instead.
