Skip to content

First steps

Allowed IPs, protection mode and alerts, in the right order.

Once installed, the server already sends events but doesn’t block anything yet. Do these three steps before leaving it alone.

1. Add your IP to the allowed IPs

On the server page, in the Firewall area, use Add allowed IP with the IP or network you manage the server from. Allowed addresses are never blocked, not even by mistake.

2. Turn on protection mode

Still on the server page, use Enable protection. From then on, every attack detected by a service sensor requests a block, and every block goes through the trail:

  1. Detected: the detector read the log and identified the attack.
  2. Block requested: the dashboard asked the agent to block.
  3. Applied, reported by agent: the agent applied it and sent a receipt.
  4. Firewall read verified: a kernel read confirmed the rule.

If the receipt or the read is missing, the state stays unknown. That is not success.

3. Pick your alerts

Under Alerts, choose the channels: email on Dev; email, webhook, Slack and Telegram on Pro. If you prefer less noise, turn on the daily and weekly digests.

Going further