Airlock Anomaly Shield configuration

The Airlock Anomaly Shield machine learning service can be fully configured via the Configuration Center UI.

Chapter-related prerequisites

An Airlock Anomaly Shield license must be available.

You must be logged in as an admin in the Airlock Gateway Configuration Center.

Schematics of the Airlock Anomaly Shield UI

The configurational tasks involved in setting up the machine learning service are relatively complex because settings have to be made at different places of the Configuration Center. The following graphic will help you to understand the configurational context and how things are connected. The link list below will help you to directly navigate within this online help when following the graphic.

Airlock Anomaly Shield schematic drawing

Step #	GUI description	Configuration instructions
1. Application (configured) in Airlock Anomaly Shield	Submenu – Anomaly Shield	Preconfigure and Airlock Anomaly Shield application
2. Training data settings	Section – Training Data Collection Anomaly Shield Model Management	Preconfigure and Airlock Anomaly Shield application Training and model enforcement
3. Mapping configuration	Section – Application Mapping details page: Section – Anomaly Shield	Preconfigure and Airlock Anomaly Shield application
4. Traffic exclusion for training data collection	Section – Training Data Collection	Traffic matcher configuration Application detail page
5. Anomaly detection/response settings	Section – Anomaly Response	Traffic Matcher and Anomaly Response configuration Reducing false-positives Miscellaneous tuning
6. Response rule exception(s)	Section – Anomaly Response	Traffic Matcher and Anomaly Response configuration Reducing false-positives
7. Response rule(s)	Section – Anomaly Response	Rule detail page
8. Trigger, pattern and rule configuration	Traffic Matchers detail page	Trigger and Pattern detail page

Chapter content

10.1.1. Part 1 – Preconfigure an Airlock Anomaly Shield application

10.1.2. Part 2 – Training and model enforcement

10.1.3. Part 3 – Trigger, pattern and rule configuration

10.1.4. Part 4 – Activate detection and response action (log-only mode)

10.1.5. Part 5 – Analyze and adjust threat handling settings

10.1.6. Optional configuration of Traffic Matchers

10.1.7. Recommendations for assigning mappings to Anomaly Shield applications

10.1.8. Airlock Anomaly Shield logs, tuning and advanced configuration

Further information and links

For a general introduction, see: Airlock Anomaly Shield
For a brief example of setup, usage and operation, see: Airlock Anomaly Shield logs, tuning and advanced configuration