Quarantined

Display and manage the list of quarantined traffic sources

Overview

The Quarantined List page shows a list of traffic sources that have triggered one or more Dynamic Rules. While a traffic source is on this list, Link11 WAAP responds to all of its requests automatically with the Dynamic Rule's Action.

This is often used to ban a persistent violator of other security rulesets, but it can also be used merely to monitor a traffic source for a period of time. An explanation of the quarantining process is here.

Administration and Use

Viewing quarantines

Each quarantined traffic source will have an entry in the list. Long lists will be broken up across multiple pages, which can be navigated using the controls at the bottom of the page.

The overall list can be sorted according to the values in each column by using the Filter control at the top.

Cancelling quarantines and preventing False Positives

Traffic sources will be automatically removed from the Quarantine list when their quarantines have expired.

They can also be manually deleted. In the UI, this is done by selecting the trash icon at the end of an entry in the Quarantined List.

"Manual deletion" refers to deletion by an admin through either the UI or the API. Both methods produce the same results, as described below.

When a traffic source is manually deleted from the list, L11WAAP understands this to mean that the quarantine was a False Positive.

Therefore, when the next cycle of Dynamic Rule evaluation occurs, the Rule's corresponding Global Filter will be updated by removing the traffic source from its Rule list. Subsequent requests from that traffic source will not automatically receive the Rule's Tags and Action., unless/until that traffic source violates the Dynamic Rule again.

To exempt the traffic source from further Dynamic Rule enforcement, an admin should add appropriate tag(s) to the Dynamic Rule's Exclude list.

If L11WAAP has quarantined a traffic source and you wish to reverse this decision, the procedure above (editing the Quarantine list) should be performed. L11WAAP will update the corresponding Dynamic Rule and Global Filter automatically. Do not try to accomplish this by editing the Global Filter itself (which is non-editable in the UI, but could still be changed via API). Manually editing the Global Filter will not work; the next time Dynamic Rules are evaluated, the system will take everything that's currently quarantined and add it back to the Global Filter.