Blacklisted Ports

Define network ports that shouldn't be open on your endpoints. EndpointOps flags (and can alert on) endpoints listening on a blacklisted port.

Availability

Blacklisted Ports is available on EndpointOps editions and above. If you don't see it in the menu, your license doesn't include it.

How to get here

You reach this page through Settings, so you need administrator (settings) permission. If you don't see the Settings icon, ask your administrator for access.

1. Sign in to EndpointOps.
2. In the top-right of any screen, click the Settings (gear ⚙️) icon.
3. In the Settings menu on the left, open System Settings and click Blacklisted Ports.

Navigate to: Settings → System Settings → Blacklisted Ports

URL path: /settings/system-settings/blacklisted-ports

The Blacklisted Ports screen

Columns: Name, Ports, Status, Created On. The Status column is a switch you can flip in the list to enable or disable a rule. Each row also has edit (✏️) and delete (🗑️).

The toolbar

Above the list, the same toolbar appears on every list screen:

• Create- add a new item (opens a form panel from the right).
• Refresh- reload the latest data.
• Export- download the current list.
• Columns- choose which columns to show (covered under "Choosing which columns to show" below).

Working with the list

These controls behave the same on every list:

• Search- type in the Search… box above the table to filter rows as you type.
• Sort- click the arrows in a column header to sort by that column.
• View details- click a row's link in the first column to open a read-only view.
• Edit / delete- use the edit (✏️) and delete (🗑️) icons at the end of a row.
• Pagination- when a list runs to more than one page, use the page controls at the bottom-right and the / page selector to change how many rows show.
• Permissions- you only see Create, edit, and delete if your role grants the matching permission; otherwise the screen is read-only.

When you save a new or edited record, a success message appears, the panel closes, and the list refreshes. Required fields are marked with a red asterisk.

How do I add a blacklisted-port rule?

1. Click Create. The Add Blacklisted Port panel opens.

   

2. Fill in the fields (red asterisk = required):

   Field	Required	Notes
   Name	Yes	A label for the rule.
   Status	-	Enable or disable the rule (on by default).
   Raise Alert	-	Raise an alert when a match is found (on by default).
   Ports	Yes	One or more ports or ranges, e.g. 5000, 8000-8010. Type and press enter to add each.
   Severity	Yes (if Raise Alert)	The alert severity.
   Add Actions	No	Integration actions to run on a match.
   Add Remediations	No	Remediations to attach.

3. Click Create.

Alert options appear with Raise Alert

Severity, Add Actions, and Add Remediations only show when Raise Alert is on. Turn it off to simply flag matches without alerting.

Choosing which columns to show

Click the Columns icon on the right of the toolbar to open the column picker.

Tick the columns to show, untick to hide, drag to reorder, then click Apply.

Related

• Threat Database- block known-bad hashes and IPs.
• Policy Management → Alert Configurations- manage the alerts these rules raise. (coming)