Version v26.06

Added widget category “Pass”. Widgets in this category display sFlow from MITIGATOR on passed traffic.

• General WL + TWL Bypass – rate of traffic bypassed to system output by WL and TWL countermeasures in General Protection;
• All Policies WL + TWL Bypass – total rate of traffic bypassed to output of all protection policies by WL and TWL countermeasures.

A button for copying policy settings via clipboard has been added to the “Settings” tab in the protection policy.

When copying, the scope is selected. You can copy:

• countermeasure parameters;
• countermeasure parameters and autodetection settings;
• all policy parameters and settings.

Settings are saved to clipboard in JSON format and can be applied to another protection policy, for example, on another MITIGATOR cluster. Application will completely replace all current protection policy settings with new ones.

Added PASS action that allows excluding traffic matching the filter from countermeasure processing. For such rules, specifying a limit and period is not required.

Example:

# this set of rules will drop all traffic from an IP address if more than
# 10 packets arrive from it within 3 seconds via TCP on port 80,
# containing the string `\sLOGIN\s[^\n]{100}`, unless it's traffic from IP address 175.180.90.0.

PASS ACL src 175.180.90.0 dport 80
PACKETS 10 PERIOD 3 ACL tcp dport 80 REX \sLOGIN\s[^\n]{100}

Added PASS action that allows excluding traffic matching the specified TLS fingerprint from countermeasure processing.

For example, if the following rule is set:

PASS JA3 771,4866-4867-4865-49191-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2

and the checkbox “Apply thresholds for other JA3/JA4” is set with a threshold of 10 packets per second, then when receiving more than 10 ClientHello per second, the FTLS countermeasure will block any ClientHello except those matching the JA3 fingerprint from the PASS rule.

Now for rules with block and alert actions you can check the value of the $host field.

Regular expressions are supported, which allows describing a pattern that values in the field should (host) or should not (not host) match.

Also added the keyword host-ip, which allows responding to specification of an IP address in the $host field.

Examples:

# Block IP address for 300 seconds where the value in the $host field
# matches the pattern `^api\.example\.com$`:

block 300 host ^api\.example\.com$

# Block IP address for 120 seconds where the value in the $host field
# does not match the pattern `^internal\.example\.com$`:

block 120 not host ^internal\.example\.com$

# Create entry in event log when receiving from IP address
# two or more requests within 10 seconds containing an IP address in the $host field:

alert host-ip limit 2 period 10

Added support for sending to MAX messenger:

• system event notifications;
• packet capture files;
• incident reports;
• regular reports.

A new page “PSG Service” has been added to System Settings, where you can set connection parameters to the service and define access level to service functions for groups.

The change optimizes resource consumption by the packet handler when there are many protection policies with activated geo-filtering.