Network VirusWall Enforcer can detect and block any known C&C server by integrating with Deep Discovery Inspector (DDI). This dynamic list monitors the network and checks all IP addresses against the DDI Virtual Analyzer C&C server list. If the Network VirusWall Enforcer Threat Mitigation feature is enabled, any detected C&C server will be added to the C&C Block List. Network VirusWall Enforcer will then block all subsequent connections to and from the C&C server.
If necessary, servers can be removed from the block list or added to the Approved list. Deleting a server from the block list may temporarily allow connections, but if Threat Mitigation is enabled, it will continue to detect the C&C server and add it to the list again. Adding a server to the Approved means all connections to and from the server are allowed.
WARNING: Add only critical servers or nodes to the Approved List.