Skip to main content

Documentation Index

Fetch the complete documentation index at: https://altostrat.io/docs/llms.txt

Use this file to discover all available pages before exploring further.

Security Essentials policies attach curated network threat lists to managed sites. Each list includes operational metadata such as prefix count, BGP community, update interval, and last updated time so you can understand what the policy is doing before you attach it.

​
Prerequisites

  • You understand which sites should use the policy.
  • You can test critical applications after attaching a new policy.
  • You have a rollback plan for high-sensitivity environments.

​
How It Works

Security Essentials policies are made from one or more list categories. SDX keeps the lists updated, and the policy determines which sites receive that protection. List metadata helps you review operational impact.
FieldWhy it matters
Prefix countShows the approximate size of the list. Larger lists can have broader impact.
BGP communityIdentifies the route community used by the mitigation list.
Update intervalShows how frequently the list is refreshed.
Last updatedHelps you verify freshness before rollout.
Treat DoH and DoT related categories carefully. Blocking public encrypted DNS providers can strengthen DNS enforcement, but it can also affect clients that rely on those resolvers.

​
Attach a Policy

  1. Open Policies and select Security Essentials.
  2. Create or edit a policy.
  3. Select the list categories that match your risk posture.
  4. Review prefix count and update metadata for each selected list.
  5. Attach the policy to a small set of representative sites first.
  6. Test critical traffic paths.
  7. Roll out to the remaining sites after validation.

​
Advanced Rollout Pattern

For production fleets, use a staged rollout.
  1. Attach the policy to a low-risk pilot site.
  2. Monitor connectivity, support tickets, and Fault Logging.
  3. Expand to a tagged group of similar sites.
  4. Keep a stricter policy for higher-risk networks and a conservative policy for sensitive business locations.

​
Troubleshooting

If a destination stops working after policy attachment, compare the timing of the failure with the policy change, test from a site without the policy, and review whether the destination belongs to a selected list category. If the policy is too broad for that environment, detach it or move the site to a narrower policy.
Security Essentials reduces exposure to known-risk networks. Use DNS Content Filtering for web category control and Security Groups for explicit firewall intent.