See what gate42 blocked
Find intrusion alerts, blocked DNS names and the devices behind them.
| To see | Go to |
|---|---|
| Attacks, malware and applications Suricata found, with the device and whether it was blocked or only allowed (reported) | Services › Intrusion Detection › Administration › Alerts |
| Suricata's own log (rules loaded, errors) | Services › Intrusion Detection › Log File |
| DNS queries, the most blocked names and the clients asking for them | Reporting › Unbound DNS |
| Traffic per device, port and application port over time (switch it on first under Reporting › NetFlow) | Reporting › Insight |
Find a device's alerts
In Alerts, type the device's address in the search box. Alerts name the device on your LAN, because intrusion detection watches the LAN side, before NAT. Click an alert for its rule, its payload and a link to the rule's description.
Why a site does not open
- Reporting › Unbound DNS: is the name among the blocked ones? Then a DNS list blocks it: protection or web filtering say how to allow it.
- Alerts: a blocked alert for the device at that time? Then intrusion prevention dropped it: Block attacks says how to change the rule.
- Neither: check the firewall rules (Firewall › Log Files › Live View).
Keep the logs longer
By default the alert log rotates weekly and keeps four old logs, about a month in all (Administration › Settings: Rotate log, Save logs). For audits, such as the CERT-In 180-day rule, send them to your own log server as well: System › Settings › Logging › Remote.