Alert-based firewall rule creation

Guardian can create firewall rules dynamically in response to specific alerts, providing event-driven network enforcement independent of node learning state.

Overview

The Block active alerts firewall rules strategy lets Guardian create link-blocking policies when specific alerts are triggered. Unlike the default Block unlearned strategy, which acts on node learning state, alert-based rule creation responds to real-time detection events. Guardian creates only link-blocking policies; node-based blocking does not apply in this mode.

Use this strategy when you want enforcement to be driven by detected threats rather than by whether assets have been learned.

Supported alert types

You select which alert types trigger firewall rule creation. The following types are available:

  • SIGN:MITM
  • SIGN:SCADA-INJECTION
  • SIGN:PACKET-RULE
  • SIGN:OUTBOUND-CONNECTIONS
  • SIGN:MALWARE-DETECTED
  • SIGN:MULTIPLE-ACCESS-DENIED
  • SIGN:MULTIPLE-UNSUCCESSFUL-LOGINS
  • SIGN:NETWORK-SCAN

Only the selected alert types generate firewall rules.

Severity and risk thresholds for packet rules

For SIGN:PACKET-RULE alerts, Guardian applies additional filtering before creating a firewall rule. Guardian creates a rule only when both of the following conditions are met:

  • The alert severity is greater than or equal to the configured Severity threshold.
  • The alert risk score is greater than or equal to the configured Risk threshold.

Both thresholds are integers. This lets you avoid generating rules for low-impact events and fine-tune automation based on your risk tolerance.

Note:
Both conditions must be met simultaneously. If either threshold is not reached, no firewall rule is created for that alert.