Threat Hub Settings

This part of the configuration can be found in Settings → System Settings → Threat hub.

The Threat hub settings page allows you to control how data is shared with the Progress Flowmon Threat hub service, including pseudonymization of IP addresses and domain filtering.

These settings are tenant based. An ADS administrator can configure them independently for each tenant, so a subtenant administrator who also holds ADS administrator permissions can set up pseudonymization for the subtenant without affecting the Base tenant or other subtenants. For more information about who can access this page, refer to User Permissions.

Settings

• Pseudonymization Filter: Specifies a filter whose IP addresses will be pseudonymized before being submitted to the Threat hub service. Select the appropriate filter from the drop-down list, or set it to -- Unspecified -- if pseudonymization is not required (private-range IP addresses are pseudonymized by default).

  When a filter is applied, the IP address is replaced with a hashed value. For example:

  Non-pseudonymized:

  Copy

  {
      "ip": "192.168.1.100",
      "blacklisted": 0,
      "application": null,
      "application_category": null,
      "country": "LAN"
  }
  

  Pseudonymized:

  Copy

  {
      "ip": "20333fb05b6d0f0940854cd7a79d1df7",
      "blacklisted": 0,
      "application": null,
      "application_category": null,
      "country": "LAN"
  }
  

• Excluded Domains: A comma-separated list of domains to exclude from Threat hub sharing. Domains may contain * wildcards (for example, *example.com, example.*).

Click Save to apply any changes.