ThreatSTOP - Active Internet Security - What Does ThreatSTOP do? FAQ

Partners

What Does ThreatSTOP do? FAQ

Updates Firewalls and other traffic management devices with lists.
ThreatSTOP propagates lists of IP addresses as Multi-Host DNS A records, so that Firewalls and other traffic management devices can use them in rules. This is particularly useful for dynamic lists or lists that you want to propagate to multiple devices, but only change in one place. The most common reason for this is to propagate dynamic threat feed information, and custom allow and block lists.

ThreatSTOP currently provides threat feeds taken from the Internet Storm Center's DShield project, which gathers information about hosts connecting to closed ports on thousands of firewalls worldwide, and TQMCube, which uses SPAM traps to catch spammers.

The most common use of these lists is to block and log traffic to and from these IP addresses, but they can also be used for redirecting blacklisted users to a remediation server or directing attackers to a honeynet for research.
Takes IP Reputation feed information in from other sources and archives it.
In order to create our feeds, ThreatSTOP pulls in data from sources where it is published, as it is updated, and stores it in a database.

Our core engine is an IP Reputation gathering and archiving database that is tied to a set of processes that take that information and turn it into a set of DNS files that can then be assembled into DNS lookups. These are made available using standard DNS protocols.

ThreatSTOP does not have to be limited to publishing DShield or TQMCube data. We can serve as a publishing platform for any IP Reputation feed, provided the provider of the information allows us to, and users understand that it is the data provider, not us, that decides what data is in the feed.

In short, ThreatSTOP can be a community clearinghouse for actionable feed information. If there are additional feeds that you think we should provide, please tell us .
Let users manage custom allow and deny lists.
ThreatSTOP's system allows users to create their own custom allow and deny lists, which they can then query from their devices. This simplifies the management of black and white listing the same IPs across multiple devices. It can be used to either implement a "Deny all except...." security policy, or "No matter what, I need to talk to ...." one. Other applications of this are an IP based Closed User Group (poor man's VPN) or special traffic handling such as IP wiretapping.
Archives Logs
Logs submitted to ThreatSTOP are archived for users to run reports on.
Provides Enhanced Reports
ThreatSTOP produces reports that are easier to read, and make more sense, than typical firewall log reports.

Our first reports correlate firewall log entries with the entries in Threat Feeds, allowing users to characterize what type of entity was denied. If the IP was in a DShield list, it is probably a bot or network attacker; if in the TQM lists, a Spammer.

Let us know what additional reports you think would be valuable, as this is an area under active development.
Builds on the Community Approach started by DShield
ThreatSTOP came out of the collaboration between the founder of DShield, Johannes Ullrich, and two friends from the US Army, Marc Sachs and Tom Byrnes. It was originally created to close the loop, by making the data produced through the submission of firewall log data to DShield by the DShield community easily actionable. ThreatSTOP will continue to build this community, submitting data received from our users to DShield. and enabling users to consume additional DShield feeds.

[ Back ]

Main Menu