Policy Examples
These examples show useful policies for open ports, hosting providers, and technologies.
Filter Operators
Open ports, providers, and technologies use five operators:
| Operator | Matches when | Think of it as |
|---|---|---|
| contain any of (A ⋂ B != ∅) | The asset has any of the values | A disallow list |
| do not contain any of (A ⋂ B = ∅) | The asset has none of the values | |
| contain all of (⊇) | The asset has all of the values | |
| do not contain all of (⊅) | The asset doesn’t have all of the values | |
| do not only contain (⊄) | The asset has a value that isn’t in the list | An allow list |
Open Ports
Internal domains exposing ports
Some domains aren’t supposed to expose any open ports to the internet, for example because they should be behind a VPN. Scope the policy to those domains by asset name, then add a condition for the number of open ports being more than 0.
Ports worth monitoring
These ports are good candidates for a disallow-list policy with contain any of:
| Category | Ports |
|---|---|
| Routing | DNS: 53, 5353. SMTP: 25, 465, 587, 2525. BGP: 179 |
| NetBIOS and CIFS | NBNS: 137, 138. NetBIOS Session Service: 139. SMB: 445. NFS: 2049 |
| VoIP | SIP: 5060, 5061. Ventrilo: 3784. Viber: 4244, 5242, 5243, 7985. h323: 1720. TeamSpeak: 9987 |
| Remote management | FTP: 20, 21, 2121. SSH: 22, 2022, 2122, 2222. Telnet: 23, 107, 992. RSH: 514. RDP: 3388, 3389, 3390. VNC: 5800, 5900, 5901, 10348. SNMP: 161, 162. Portmapper: 111. Ident: 113. MSRPC: 135, 445, 593 |
| Databases | LDAP: 389, 636. Aurora/MySQL/MariaDB: 3306, 33060. PostgreSQL: 5432. MSSQL: 1433, 1434. MaxDB: 7210. Oracle DB: 1830, 1521, 2483, 2484. Pervasive SQL: 1583, 3351. OrientDB: 2480. SAP SQL Anywhere: 2638. Firebase/Interbase: 3050. Sybase: 4100, 5000. CouchDB: 5984. Redis: 6379. Cassandra: 7000, 7001, 9042. Neo4J: 7473, 7474. Apache Solr: 8983. Riak: 8087, 8098. ArangoDB: 8529. ElasticSearch: 9200, 9300. Memcache: 11211. MongoDB: 27017, 27018, 27019, 28015, 28017, 29015 |
| Industrial control systems | Siemens S7: 102. Modbus: 502 |
Hosting Providers
Unknown hosting providers can indicate unaccounted-for assets or shadow IT. Subdomains that point (CNAME) to apps not hosted by you, such as support pages or documentation, will likely show up on other platforms than expected. Check the breaches a new policy generates and adjust it to avoid false positives.
- One mandated provider: if all assets, or a subscope, should be behind Cloudflare, use the Providers field with do not contain all of or do not contain any of. These do the same when the list has one value. Use other fields, such as the asset name or country, to set the subscope.
- Several allowed providers: use do not only contain and list all accepted providers. A domain that uses any other provider creates a breach.
- Providers to watch: use contain any of and list the providers. Every domain that uses one of them creates a breach.
- Multi-cloud domains: domains that point to IP addresses on different platforms are worth investigating. Find them with a condition for more than one active provider.
Technologies
- Technologies you want to phase out: use contain any of, for example to find where PHP and WordPress are still used, or where a technology with a newly exploited vulnerability is used.
- Technologies every domain should have: if all domains should use Cloudflare or Azure CDN, use do not contain any of to find domains that use neither.
- Required combinations: if all domains should run both HSTS and Cloudflare, use do not contain all of to find deviations.