On election night, threat intel flags a command-and-control network…

Question

On election night, threat intel flags a command-and-control network talking to a results-app group. Security needs a fast Distributed Firewall block that must not live forever. How should the Emergency category be used?

Accepted Answer

Add a time-bounded Emergency deny to the C2 group, then remove the rule when the indicator expires — Emergency is the red pull-handle, not a new permanent wall around the city. Slap a time-bounded deny on that C2 group, then take the handle off the wall when the indicator expires.

Answer

Place a permanent any-any deny in Application and never schedule a review

Answer

Disable Identity Firewall until the canvass is certified

Answer

Change the Tier-0 default origin to blackhole the entire civic WAN

On election night, threat intel flags a command-and-control network talking to a results-app group. Security needs a fast Distributed Firewall block that must not live forever. How should the Emergency category be used?

Short Explanation

Full Explanation