IP Reputation

IP Reputation is a mechanism that provides per-client IP context to Airlock Anomaly Shield (AAS) models. Shared across AAS-enabled applications, IP Reputation uses prior AAS evaluations to compute scores that help AAS react faster and be more strict with suspicious clients.

How it works

AAS maintains two scores for each client IP address:

Both scores increase with suspicious activity and decay during benign periods. The scores are computed from AAS model outcomes across all AAS‑enabled applications. The resulting per‑client IP scores are shared for use in each application’s decision logic.

Activation and configuration

IP Reputation is automatically active when Detection Mode is enabled for at least one application. There is no separate UI control.

Exceptions and exclusions

IP Reputation integrates with existing Traffic Matchers. Your current IP allowlists in Traffic Matchers continue to apply — no additional configuration is required.

Deactivation

IP Reputation cannot be disabled independently. To prevent score computation, disable AAS detection.

Logging

When a score changes for a client IP, AAS emits the following log events:

Use these events to monitor score evolution and correlate reputation changes with request/decision logs to understand behavior changes and investigate spikes.