Version v26.06

On the “Top Policies” tab of the “Dashboard” page, graph areas “WL + TWL Bypass Top IPv4, pps” and “WL + TWL Bypass Top IPv4, bps” have been added, which display the top of protection policies with the highest traffic bypass by WL and TWL countermeasures.

Widgets have been added to the “Monitoring Objects” category:

• All traffic by MO;
• Inbound traffic in both domains by MO;
• Outbound traffic in both domains by MO.

Added widget category “Pass”. Widgets in this category display sFlow from MITIGATOR on passed traffic.

New filters have been added to the “Flow Analysis” page in monitoring, protection policy, and monitoring object, useful for initial setup of a monitoring object and for taking into account more traffic classification features.

• inbound_mo — inbound traffic across all domains;
• outbound_mo — outbound traffic across all domains;
• composite_mo — all traffic of the object.

• General WL + TWL Bypass – rate of traffic bypassed to system output by WL and TWL countermeasures in General Protection;
• All Policies WL + TWL Bypass – total rate of traffic bypassed to output of all protection policies by WL and TWL countermeasures.

A button for copying policy settings via clipboard has been added to the “Settings” tab in the protection policy.

When copying, the scope is selected. You can copy:

• countermeasure parameters;
• countermeasure parameters and autodetection settings;
• all policy parameters and settings.

Settings are saved to clipboard in JSON format and can be applied to another protection policy, for example, on another MITIGATOR cluster. Application will completely replace all current protection policy settings with new ones.

Now in the FRB countermeasure you can enable logging of blocking reasons.

The log records the fact that a specific rule triggered for an IP address.

instance_id,instance_name,created_at,ip,reason,rule
1,Mitigator0,2022-09-02 10:44:31.53622 +0000 UTC,10.0.2.254,LimitBps,BITS 200 ACL icmp

Added support for configuring multiple alternative tunnels in a protection policy. When the active tunnel becomes unavailable, traffic is switched to the next one in order.

A “SNMP Trap Transmission” page has been added to System Settings, allowing to configure sending SNMP Trap messages to monitoring systems.

To get the MIB file, make an API request /snmp/event_mib with the GET method. A detailed description of the REST API as an HTML page and OpenAPI specification is available in the built-in help.

Added a setting for the retention depth of the IP address blocking reasons log for the FRB countermeasure.

Now for rules with block and alert actions you can check the value of the $host field.

Regular expressions are supported, which allows describing a pattern that values in the field should (host) or should not (not host) match.

Also added the keyword host-ip, which allows responding to specification of an IP address in the $host field.

Examples:

# Block IP address for 300 seconds where the value in the $host field
# matches the pattern `^api\.example\.com$`:

block 300 host ^api\.example\.com$

# Block IP address for 120 seconds where the value in the $host field
# does not match the pattern `^internal\.example\.com$`:

block 120 not host ^internal\.example\.com$

# Create entry in event log when receiving from IP address
# two or more requests within 10 seconds containing an IP address in the $host field:

alert host-ip limit 2 period 10

Added support for sending to MAX messenger:

• system event notifications;
• packet capture files;
• incident reports;
• regular reports.

If the flag is not set, notifications about changes in routing rules will contain only the fact that changes were made, but will not contain the details of these changes.

A new page “PSG Service” has been added to System Settings, where you can set connection parameters to the service and define access level to service functions for groups.

Now the titles of graph areas and widgets have color fill depending on the type of traffic displayed on them. The changes affected the following interface pages:

• “Dashboard” - “Top Policies” tab,
• “Overview” - “Top Policies” widgets,
• “Flow Analysis” - “Dashboard” (Input, Drop, Pass) and “Top Policies” tabs,
• “Protection Policies” - “Flow Analysis” tab (Input, Drop, Pass),
• “Monitoring Objects” - “Monitoring Object” page, “Flow Analysis” tab (Input, Drop, Pass).

The change optimizes resource consumption by the packet handler when there are many protection policies with activated geo-filtering.