A block list blocks traffic as it flows through a network device before the deep packet inspection engine analyzes it. A global block list applies to all network devices managed by Trellix ESM.
You can set up a block list for individual network devices on Trellix ESM. A global block list only allows permanent block list entries. To set up temporary entries, use the network device Block List option.
Each network device can use the global block list. The feature is disabled on all devices until you enable it.
The Global Block List Editor allows you to:
Configure blocked source and destination entries to block on all ports, or a specific port.
Configure entries with a masked range of IP addresses with the port set to any (0) and the duration must be permanent.
After typing an IP address or host name, the button next to that control says either Resolve or Lookup based on the value entered. If it says Resolve, clicking it resolves the entered host name, populates the IP Address field with that information, and moves the host name to the Description field. Otherwise, clicking Lookup performs a lookup on the IP address and populates the Description field with the results of that lookup.
Tip
Some websites use more than one IP address, or have IP addresses that are not always the same. Don't rely on this tool to make sure blocking of websites.