threat intelligence
Help articles tagged “threat intelligence”.
Choose your alerts, and get them on your phone
Open Security ▸ Alerts & detection… to pick which events raise an alert. Two are on by default. Add an ntfy topic or HTTPS webhook to push alerts to your phone (Pro plan and trial).
GeoIP, threat or category lists aren't updating
Run Tools ▸ Feeds ▸ Update … now and watch the status line in Settings. Most failures come from a pending "Verify this PC" check, a changed source URL, or a network that blocks the download.
Filter the Live tab to find a process, port or threat
Use the filter bar above the Live tab's list. Type a name, IP or port, or pick Trust, State, Activity or Min rate; every filter you set must match, and clearing them brings the rows back.
The welcome screen and setup wizard, step by step
On first launch NetSecWall shows a Welcome dialog for reference data and a blocking preset, then a five-page setup wizard. The recommended choice is pre-selected on every page.
The IP dashboard and one-click IP investigation
Double-click an address in the Live tab's By IP view to open its dashboard: location, network owner, threat status and the apps that used it. Right-click and choose Investigate IP to check it online.
The threat-intelligence feeds NetSecWall uses, and keeping them updated
NetSecWall checks every public address your apps reach against six free threat-intelligence IP lists, on your PC. They refresh daily, or on demand from Tools ▸ Feeds.
Check app hashes with VirusTotal and your own IOC list
NetSecWall fingerprints each program that goes online (SHA-256) and checks it against your own list of known-bad hashes and, with your VirusTotal API key, VirusTotal. Only the hash is sent.
Exactly what NetSecWall sends over the internet
Your traffic history, DNS log and rules never leave the PC. NetSecWall contacts netsecwall.com for its license check, its reference lists and update checks; everything else is opt-in or on click.
Threat intelligence and behavioral detection
NetSecWall checks every remote address against six public threat lists, and separately scores each program's behavior from 0 to 100. Lists catch known-bad addresses; behavior catches new ones.