Configuring Shield
Shield is off by default — you enable it per resource, on the resource’s policy card (also reachable from the quick protection popover in the resource list).
Enable attack blocking
Section titled “Enable attack blocking”Turn on Attack blocking. Two prerequisites, both surfaced honestly in the panel:
- Windows Firewall must be on (Shield blocks by writing firewall rules).
- The agent must be a recent version (old agents show block pending instead of enforcing).
The burst rule: threshold & window
Section titled “The burst rule: threshold & window”The core rule — N failed attempts within M seconds from one IP → block it:
| Setting | Default |
|---|---|
| Threshold | 20 failed attempts |
| Window | 600 seconds (10 min) |
Lower the threshold for stricter blocking; raise it if a shared egress (NAT/VPN) produces legitimate bursts.
Block durations (escalating)
Section titled “Block durations (escalating)”The first block lasts the base duration (default 15 minutes). If the same IP returns after a block expires, its next block is longer, doubling up to the maximum (default 24 hours). Blocks expire automatically — no cleanup to remember.
Persistent blocking (low-and-slow)
Section titled “Persistent blocking (low-and-slow)”Some bots stay under any rate threshold by trying a few passwords per hour, forever. The persistent rule counts an IP’s cumulative attempts; crossing that total (default 100) earns a long block (default 30 days). Set the threshold to 0 to disable the rule, or the duration to 0 for a permanent block.
Private IPs
Section titled “Private IPs”By default Shield does not block private/LAN ranges — a misbehaving printer or a mistyped password storm inside the office shouldn’t cut the machine off its own network. If your threat model includes lateral brute-force, enable Block private IPs deliberately.
Safe IPs (never block)
Section titled “Safe IPs (never block)”Add your management addresses, office/VPN egress, and monitoring probes to Safe IPs. These are never blocked — regardless of any rule above. If the machine is reached through a gateway or NAT, verify first which source address the events actually show, then safelist it; otherwise a burst of typos could block the very gateway everyone uses.
Suggested starting points
Section titled “Suggested starting points”- Internet-facing RDP server: defaults are sane — enable and watch for a week.
- Behind VPN only: consider higher threshold + Block private IPs off (default).
- High-value host: lower threshold, longer max duration, persistent rule on.