security basics
Help articles tagged “security basics”.
Reading the ATT&CK tab: incidents and kill-chain tactics
The ATT&CK tab fuses warning signs from a parent program and the programs it launched into one incident, scores it by how many attack stages it spans, and maps it on a 12-tactic matrix.
Cut all internet access instantly with Block all outbound
Choose Protection ▸ Filtering mode ▸ Block all outbound (panic). Every program on the PC loses internet access until you switch the filtering mode back to Monitor only or Learning.
Choose your alerts, and get them on your phone
Open Security ▸ Alerts & detection… to pick which events raise an alert. Two are on by default. Add an ntfy topic or HTTPS webhook to push alerts to your phone (Pro plan and trial).
The Detections tab: what a risk score means
The Detections tab scores each program that is online right now from 0 to 100 by adding up warning signs it shows. At 40 or more it is worth a look, but a score is a lead, not a verdict.
How to install NetSecWall on Windows 10 or 11
Download the installer from netsecwall.com, check its SHA-256 checksum and its SSL.com code signature, then run it and accept the administrator prompt. The 7-day trial starts by itself.
Isolate a device and release it
Click Isolate on the Agents page to turn on Block ALL internet on that PC, and Release (NetSecWall 1.2.1 and later) to end it. Isolation also cuts the PC off from a server on another machine.
Lock NetSecWall with a settings password
Open Protection ▸ Settings password…, type a password twice and click Save. Settings, protection changes, parental controls, the Rules tab, quitting and allowing new apps then need it.
The threat-intelligence feeds NetSecWall uses, and keeping them updated
NetSecWall checks every public address your apps reach against six free threat-intelligence IP lists, on your PC. They refresh daily, or on demand from Tools ▸ Feeds.
Check app hashes with VirusTotal and your own IOC list
NetSecWall fingerprints each program that goes online (SHA-256) and checks it against your own list of known-bad hashes and, with your VirusTotal API key, VirusTotal. Only the hash is sent.
Stop alerts for trusted apps and publishers
Add a program by path, or a whole publisher, under Security ▸ App whitelist…. Whitelisted apps are no longer risk-scored, so they stop raising suspicious-process alerts and incidents.