Threat Intelligence (Value Added Services)
최신 업데이트：2026-03-23 14:24:21
Reading time: About 4 minutes
Prerequisites: Threat Intelligence value-added service must be enabled
What Is Threat Intelligence
Threat Intelligence is a database of known malicious IPs and sources built from global security data. Once enabled, the platform automatically handles requests that match threat intelligence entries based on the configured action, eliminating the need to manually maintain an IP block list.
Covered threat types:
| Type | Description |
|---|---|
| Specific Attack Risk IPs | High-risk IPs that have been blocked by the platform and continue to launch attacks, including DDoS attacks, Web vulnerability exploitation, malicious scraping, and malicious scanning |
| Industry Attack Risk IPs | High-risk IPs that have been blocked by the platform and persistently attack specific industries |
| Attack Resource Risk IPs | IP resources commonly used by attackers to launch various attacks, primarily sourced from proxies, cloud providers, data center providers, and open-source IP reputation databases |
To access: Go to Security Settings > Policies > [Target Hostname], then click the Threat Intelligence tab in the top navigation.
Configuring Actions
- Find the threat intelligence type you want to configure and select the corresponding action (Log / Deny).
- Click Deploy to apply the configuration.
| Threat Intelligence Type | Recommended Initial Action | Description |
|---|---|---|
| Specific Attack Risk IPs | Deny | These IPs are confirmed high-risk attack sources by the platform, with a low false positive rate |
| Industry Attack Risk IPs | Log (initial) → Deny | Observe the match results first, then evaluate whether blocking impacts legitimate traffic |
| Attack Resource Risk IPs | Log (initial) → Deny | Proxy and cloud host IPs may include legitimate API calls — evaluate before enabling Deny |
Note: If some of your legitimate users access the platform through proxies or cloud host IPs (e.g., corporate VPNs, enterprise clients on B2B platforms), add their IPs to the whitelist first before enabling Deny for the corresponding threat intelligence type.
Adding Threat Intelligence Whitelist Entries
For known legitimate IPs or sources, you can exclude them from threat intelligence detection by adding them to the whitelist:
- Click Whitelist Configuration to open the configuration panel.
- Configure the whitelist conditions (multiple conditions use AND logic). Set the following items as needed:
| Whitelist Type | Description | Example |
|---|---|---|
| IP/CIDR | Bypass requests from the specified IP or CIDR range | 203.0.113.0/24 |
| ASN | Bypass requests from the specified Autonomous System Number | AS12345 |
| Header | Bypass requests containing the specified header (useful for identifying legitimate partners) | X-Partner-ID: abc123 |
- Click Save, then click Deploy to apply the configuration.
Intelligence Update Frequency
The threat intelligence database is updated daily and requires no manual intervention. Newly added malicious IPs take effect automatically after each update.