Dropping intruders specific active connection

[Masood_ahmad]

Hi, Can someone confirm if SandBlast Threat Extraction can help dropping attacker's specific active connection? or we need to create a SAM rulebase by looking at active log connection that we want to block

[Marco_Valenti]

it is not the purpose of threat extraction to be honest , you can achieve that with the antibot blade but this is post infection , threat extraction extract active code execution or similar from a file

[PhoneBoy]

If you want to block a specific active connection, you need to use SAM or fw samp.