Stopping an Attack

When someone connects to Lumen, the connection comes from an IP address, such as 192.0.2.7. The alert shows these addresses so you can see where the sign-in attempts are coming from.

For example, suppose the alert shows hundreds of failed sign-ins from 192.0.2.7. You can stop new connections from that address with:

seclab block 192.0.2.7

You should see:

Blocked 192.0.2.7 at the company's edge.

The block stops new attempts from that address. It does not block everyone else. Before blocking an address, check how it was used: a coworker who mistyped their password once should still be able to sign in.