Security Tools
Firewall Dashboard
Traffic analysis, rule management, and threat blocking.
Firewall Dashboard
The Firewall dashboard monitors network traffic, manages access rules, and blocks malicious connections in real-time.
Interface Overview
1. Traffic View
Live network traffic display:
| Column | Description |
|---|---|
| Time | Connection timestamp |
| Source IP | Origin of the connection |
| Dest IP | Target of the connection |
| Port | Destination port |
| Protocol | TCP, UDP, ICMP |
| Action | Allowed, Blocked, Flagged |
| Bytes | Data transferred |
2. Blocked Items
Lists of blocked entities:
- Blocked IPs - Known malicious sources
- Blocked Domains - Malware/C2 domains
- Blocked Countries - Geographic restrictions
- Blocked Ports - Restricted services
3. Active Rules
Firewall policies in effect:
RULE 1: ALLOW TCP 10.0.0.0/8 -> ANY:443 (HTTPS Internal)
RULE 2: BLOCK TCP ANY -> ANY:23 (Telnet)
RULE 3: ALLOW UDP ANY -> 8.8.8.8:53 (DNS Google)
RULE 4: BLOCK ANY 185.243.0.0/16 -> ANY (Threat Intel)4. Threat Intelligence
Real-time threat feeds:
- IP reputation scores
- Known C2 servers
- Malware distribution sites
- Phishing domains
Key Features
Traffic Analysis
Investigate network patterns:
- Filter by source/destination IP
- Look for unusual ports or protocols
- Check data volumes (large transfers = potential exfil)
- Identify beaconing patterns (regular intervals)
Quick Actions
Respond to threats immediately:
| Action | Use Case |
|---|---|
| Block IP | Stop traffic from malicious source |
| Block Domain | Prevent DNS resolution to C2 |
| Allow IP | Whitelist false positives |
| Create Rule | Custom traffic policy |
Connection Patterns
Watch for these suspicious patterns:
- Beaconing - Regular connections at fixed intervals (C2)
- Port Scanning - Connections to many ports in sequence
- DNS Tunneling - Unusual DNS query volumes
- Lateral Movement - Internal-to-internal unusual traffic
Alert Types
| Severity | Examples |
|---|---|
| Critical | Known C2 connection, active exfiltration |
| High | Connection to threat intel IP, port scan |
| Medium | Unusual outbound port, high volume transfer |
| Low | Blocked connection attempt, policy violation |
Investigation Workflow
- Alert triggers - Firewall flags suspicious traffic
- Check IP reputation - Is the IP on threat lists?
- Review connection history - First time or repeated?
- Correlate with XDR - What process initiated this?
- Decision - Block, allow, or investigate further
Tips for Success
Beaconing is a key indicator of C2 - look for connections that happen at regular intervals (every 5 minutes, every hour, etc.).
- High-port to high-port traffic is often suspicious
- Connections to IPs without DNS resolution deserve scrutiny
- Internal hosts connecting to many other internal hosts = lateral movement
- Look for geographic anomalies (connections to unexpected countries)