Eight data streams, one distribution point

Web content categories

11 million+ domains · 63 categories

More than eleven million domains are classified into 63 categories: from malware and phishing to gambling, from adult content to social media and business applications. The categories sit in five groups — security threats, legal liability, adult and sensitive content, bandwidth, business and productivity. A product binds the rule to the category rather than to the domain, so a site that did not exist yesterday falls under the right rule today.

Application identification

2,000+ applications · 50,000+ signatures

More than two thousand applications are recognised through over fifty thousand signatures, independently of the port in use. Without this, a rule such as “throttle video streaming during work hours” cannot be written at all, because most modern applications travel through the same door under the same encrypted protocol.

Intrusion prevention signatures

80,000+ active signatures · 55 categories

More than eighty thousand active attack signatures are maintained across fifty-five categories. A significant part of them comes entirely from our own research: we produce, verify and refresh our own indicators for command-and-control infrastructure, malware distribution points and mining networks. Stale records are retired, because a false alarm costs as much as a missing record.

Country and IP reputation

250+ countries and regions

Current address ranges for more than two hundred and fifty countries and regions, together with attacker, scanner, anonymiser, command-and-control and spam-source address sets. Geographic restrictions and reputation-based decisions run on this data: you can tell whether a login attempt came from the office or from behind an anonymiser.

Device identification

58,000+ vendor records

With more than fifty-eight thousand vendor records and our own fingerprint tables, the device joining the network is identified: phone, computer, printer, camera, smart-home device. Different policies can then apply to different device classes; a guest phone need not be governed by the same rules as a camera.

Internet service addresses

Current address ranges published by the vendors of common cloud and business services are collected and delivered to the products. Rules such as “allow this service” or “allow only this service” therefore do not break silently when a provider changes its addresses.

Anti-spam

3,000+ content rules

More than three thousand content rules and sender reputation sets are provided for mail traffic. Rules are delivered in structured form and scored by the product’s own engine. Which score leads to which action — tag, quarantine, reject — is your decision.

File reputation

1 million+ fingerprints

More than one million known malicious file fingerprints are maintained. Whether a downloaded file — or one entering a backup — has previously been recorded as malicious is checked instantly. The file itself is never sent to us; only the fingerprint is compared.