Appearance
Response and protected IPs
Theseus blocks attacking addresses at your perimeter: AWS WAF and AWS Network Firewall, Cloudflare, or a firewall: Sophos Firewall, FortiGate, OPNsense, an Azure network security group, a DigitalOcean Cloud Firewall or a Google Cloud VPC firewall. Which perimeters exist depends on what is configured (see AWS, Cloudflare); PERIMETER_VENDORS can pin the choice. With no perimeter configured there are no perimeter pages and no block action: the console suggests muting instead.
Blocking on endpoints themselves (host firewall) is not offered from the console.
Block an address
From an alert (Block source IP), Pallas, a policy rule, or the WAF and firewall pages:
- Choose Block and, when more than one perimeter is configured, where to enforce it (Enforce at).
- Give a reason. The block is recorded with you, the time and the reason.
A block on a protected address is skipped and recorded as a no-op.
Blocked IPs
Response → Blocked IPs lists every blocked address on the blocking points the stack has: the AWS Network Firewall (layer 3/4) and WAF (layer 7), Cloudflare and Sophos Firewall, with layer, source, analyst, time and reason. When a Sophos Firewall is set up too, its block group's members are listed with the source Sophos Firewall (details).
- Unblock per layer, or several at once.
- Sync from AWS reads back what is actually in AWS.
Active response
Response → Active response is a monitoring view of the monitoring agents' own automatic blocks (firewall-drop on endpoints): an overview and a block history (BLOCK, UNBLOCK, TIMED OUT). Manual blocking is not done here: blocking is handled at the perimeter.
Protected IPs
Admin → Protected IPs (administrators) lists the addresses and ranges that are never blocked at the perimeter, whichever path asks for the block (AWS Network Firewall, AWS WAF, Cloudflare, policy rules, Pallas). Three layers:
| Layer | Editable | Use it for |
|---|---|---|
| Managed safe-list | Yes: Add IP, single address or CIDR, with a description | Partners, scanners you run, monitoring services |
| Infrastructure ranges | Yes; applies within about a minute | Your own edge: load balancers, NAT gateways, office egress |
| Built-in internal ranges | No | RFC 1918, CGNAT, loopback, link-local, IPv6 ULA |
Add your own public egress addresses before you enable automatic blocking in the policy engine.