Airlock Anomaly Shield configuration

The Airlock Anomaly Shield machine learning service can be fully configured via the Configuration Center UI.

This chapter will give a step-by-step introduction to manually configuring all aspects of the Anomaly Shield.

Info

To get started with Anomaly Shield, see Airlock Anomaly Shield Quick Start. It provides a simple, fast, and user-friendly setup process.

Chapter-related prerequisites

You must be logged in as an admin in the Airlock Gateway Configuration Center.

Schematics of the Airlock Anomaly Shield UI

The configurational tasks involved in setting up the machine learning service are relatively complex because settings have to be made at different places of the Configuration Center. The following graphic will help you to understand the configurational context and how things are connected. The link list below will help you to directly navigate within this online help when following the graphic.

Step #	GUI description	Configuration instructions
1. Application (configured) in Airlock Anomaly Shield	Submenu – Anomaly Shield	Preconfigure and Airlock Anomaly Shield application
2. Training data settings	Section – Training Data Collection Anomaly Shield model management page	Preconfigure and Airlock Anomaly Shield application Training and model enforcement
3. Mapping configuration	Section – Application Mapping details page: Section – Anomaly Shield	Preconfigure and Airlock Anomaly Shield application
4. Traffic exclusion for training data collection	Section – Training Data Collection	Traffic matcher configuration Application detail page
5. Anomaly detection/response settings	Section – Anomaly Detection	Traffic Matcher and Anomaly Response configuration Reducing false-positives Miscellaneous tuning
6. Response rule exception(s)	Section – Anomaly Detection	Traffic Matcher and Anomaly Response configuration Reducing false-positives
7. Response rule(s)	Section – Anomaly Detection	Rule detail page
8. Trigger, pattern and rule configuration	Traffic Matchers detail page	Trigger and Pattern detail page

Chapter content

Part 1 – Preconfiguring an Anomaly Shield application

Part 2 – Training and model enforcement

Part 3 – Trigger, pattern and rule configuration

Part 4 – Activating detection and response action (log-only mode)

Part 5 – Analyzing threat handling settings

Optional configuration of Traffic Matchers

Assigning mappings to Anomaly Shield applications

Logs, tuning and advanced configuration

Further information and links

For a general introduction, see: Airlock Anomaly Shield
For a brief example of setup, usage and operation, see: Logs, tuning and advanced configuration
To get started with Anomaly Shield, see Airlock Anomaly Shield Quick Start.