Threat Intelligence Rules

Add Rule

1. Go to the Private Zone DNS Firewall page.

2. On the Threat Intelligence Rules tab, click Add Rule.

3. In the Add Rule dialog box, configure the parameters and submit the form.

   Parameter	Description
   Threat Intelligence Type	The category of threat intelligence, such as viruses and trojans, remote control, Advanced Persistent Threats (APTs), vulnerability exploits, abnormal communication, supply chain attacks, ransomware attacks, mining behavior, phishing attack, and compliance risks. By default, All Types is selected.
   Severity	Indicates the domain's association with malicious activity or the severity of its potential harm. Levels include High Risk, Medium severity or above, and Low severity or above. By default, High Risk is selected.
   Confidence Level	Indicates the reliability of the threat assessment for a domain. A high confidence level means the intelligence source is reliable and supported by sufficient evidence. A low confidence level may be due to insufficient or disputed data. Options include Low and above, Medium and above, and High. By default, High is selected.
   Query Source	The source of the DNS queries. The rule applies only to queries from the specified IP addresses or CIDR blocks. 0.0.0.0/0 represents all query sources. CIDR blocks are supported, such as 192.168.1.1/24. Single IP addresses are supported, such as 192.168.2.20. Enter each IP address or CIDR block on a new line. Overlapping IP ranges are allowed.
   Action	The action to perform on DNS queries that match the rule. The following actions are available: Allow: Allows the query to proceed. This action generates an action log and a detailed response log. Drop: Silently drops the query without sending a response. Response NXDOMAIN: Responds with an NXDOMAIN status, indicating that the domain does not exist. Response Address: Responds to the query with a specific address. You can configure multiple addresses and distribute responses using weighted or round-robin methods. The record value type must match the specified Record Type. If Record Type is set to Any type, the record value can be an IPv4 address, an IPv6 address, or a domain name. However, you cannot use both domain names and IP addresses in the same rule. Answer NOERROR (NoData): Responds with a NOERROR status but an empty answer section in the response.
   Rule Priority	The first rule that you add is always assigned a priority of 1, regardless of the value that you enter. If you assign a priority that is already in use, the new rule takes that priority value. The rule that previously had that priority, and all subsequent rules, are shifted down by one (their priority value is incremented by 1). If you assign a priority value that is greater than the total number of rules, the new rule is assigned the lowest priority (the highest number). For example, if there are four existing rules and you add a new rule with a priority of 7, its priority is set to 5.
   Rule Status	Specifies whether the rule is active. By default, rules are enabled.
   Effective Scope	The scope of the rule, which defines the DNS queries it applies to. For DNS Firewall for Private Zone, the scope is defined by your VPCs. You can also associate VPCs from other Alibaba Cloud accounts. For more information, see Associate a VPC across accounts.
   Remarks	An optional description for the rule to help you identify and manage it.

4. After the rule is added, it appears in the rule list.

   The rule list includes the following columns: Threat intelligence type/ID, Severity, Confidence level, Query source, Action, Status, Rule priority, Effective scope, Remarks, and Actions. In the Actions column, you can Edit the rule, Configure Effective Scope, and Set Priority.

Modify a rule

You can modify a rule to adjust its Threat Intelligence Type, Severity, Confidence Level, Query Source, and Action.

1. Go to the Private Zone DNS Firewall page.

2. On the Threat Intelligence Rules tab, find the target rule and click Edit in the Actions column.

3. In the dialog box that appears, modify the parameters and submit the form.

   The parameters include threat intelligence type, severity (High risk, Medium severity or above, Low severity or above), confidence level (High, Medium or above, Low or above), query source, and action (such as Respond with NXDOMAIN).

Configure effective scope

You can specify the VPCs to which the rule applies.

1. Go to the Private Zone DNS Firewall page.

2. On the Threat Intelligence Rules tab, find the target rule and click Effective Scope in the Actions column.

3. In the Effective Scope dialog box, select VPCs from your current Alibaba Cloud account or other centrally managed accounts.

   To associate a VPC from another Alibaba Cloud account, click + VPC DNS Resolution Management (Across Alibaba Cloud Accounts) to add it. VPC data in the drop-down list may have a synchronization delay. If the list is not up-to-date, please wait 30 minutes and try again.

Set rule priority

• The first rule that you add is always assigned a priority of 1, regardless of the value that you enter.

• If you assign a priority that is already in use, the new rule takes that priority value. The rule that previously had that priority, and all subsequent rules, are shifted down by one (their priority value is incremented by 1).

• If you assign a priority value that is greater than the total number of rules, the new rule is assigned the lowest priority (the highest number). For example, if there are four existing rules and you add a new rule with a priority of 7, its priority is set to 5.

1. Go to the Private Zone DNS Firewall page.

2. On the Threat Intelligence Rules tab, click Priority Rankings in the Actions column for the target rule.

3. In the Priority Rankings dialog box, enter the target priority number in the input box and click OK.

Disable or delete a rule

If you no longer need a Threat Intelligence Rules, you can disable or delete it.

1. Go to the Private Zone DNS Firewall page.

2. On the Threat Intelligence Rules tab, find the target rule.

   • Disable a rule: Disables a rule temporarily while preserving its configuration.

     Important

     Disabled rules are not matched against DNS queries. However, you are still charged for them. For more information, see Product Billing.

     1. In the Status column for the target rule, click the toggle to disable the rule.

   • Delete a rule: Permanently removes a rule.

     1. In the Actions column for the target rule, click Delete.

     2. In the confirmation dialog box that appears, confirm the deletion.