Lists

The List Management functionality within Secure60 enables administrators to maintain and enforce security policies through allow lists and trigger lists. This feature is designed to enhance the control over network access, operations, and responses based on predefined criteria.

Features

Lists are a list of List Items (Values) - that can then be applied as either:

1. Allow Lists: Allows specified entities (e.g., IP addresses, usernames, or device IDs) to access certain resources or execute specific actions without being blocked or logged as potential threats.

2. Trigger Lists: Specifies criteria that, when met, will trigger a Rule to fire its Actions. This is used to actively monitor for potentially harmful activities or compliance violations.

The same List can be used in either of the above scenarios, Its only in the application of a List to a Rule that defines whether the List is applied as an Allow List or Trigger List.

List Types

The List functionality within Secure60 supports two specific types of lists to cater to different security needs: “TEXT” lists and “IP” lists. Below is a detailed description of each list type and how they are used within the system.

TEXT Lists

TEXT lists are designed to perform straightforward text matches against monitored data. They are useful for identifying specific strings, such as command-line arguments, filenames, or user IDs that match exactly with the entries in the list.

Use Cases

• Monitoring for the use of specific commands.
• Blocking or alerting on access to particular filenames.
• Identifying actions by specific user IDs.

IP Lists

IP lists allow for storing ranges of IP addresses and querying to check if a specific IP address falls within one of these ranges. This is particularly useful for allowing or blocking network traffic based on geographical or organizational boundaries.

Use Cases

• Whitelisting IP ranges of trusted networks.
• Blocking IP ranges associated with known malicious entities.
• Monitoring access from specific geographic locations.

Getting Started

Accessing the List Management

To access the List Management functionality:

1. Login to the Secure60 portal.
2. Navigate to the Organisation Settings menu.
3. Select Lists from the tab sub menu.

Applying Lists to Rules

See the information under Rule Conditions to apply Lists to Rules

Best Practices

• Regularly Update Lists: Ensure that allow lists and trigger lists are regularly reviewed and updated to adapt to new security threats and operational requirements.
• Define Clear Criteria: Be specific and clear about the criteria for each list to avoid unintended blocks or alerts.
• Monitor List Performance: Regularly check the effectiveness of your lists and adjust them based on performance metrics and feedback.

For further assistance, contact our support team