Hello how I can configure threat shield; what are the steps to do that…
thanx a lot.
Enter download links for both IP and DNS blacklist. The github links from the docs should be ok.
Choose the lists to enable, don’t enable all lists.
See also Threat shield: DNS blacklist and Securing NS with Suricata and Threat Shields
Hello what´s the categories you recomend to activate.
Thnax for the help-
My categories/types of enabled lists are Attacks, Reputation and Malware in IP blacklists and Malware, Ads and Phishing in DNS blacklists.
But don’t enable lists just by category, please follow the instructions because enabling wrong lists may block wanted servers/services.
Where is the instructions.?
But you take all malware, all attacks…? or someone in specific.?
I just followed the links I posted above. Here are my enabled lists (but it’s just a basic setup, you may need more):
IP lists:
DNS lists:
I want the basic.
If I want to block stream video I can do with this.?
No, threat shield just blocks IPs, it’s not intended to block streaming.