New endpoints get mapped
A scan can find a newly reachable notebook, model service, or data interface before its access review is complete.
Industry blocklist
AI Infrastructure blocklist
Keep a current edge rule around model, development, and data services as AI deployments change.
The coverage
What our sensors observed
Our sensors saw probes against model services, development notebooks, orchestration, and supporting data platforms. The mapping covers interfaces used to build, run, and manage AI workloads.
Why use this feed
A notebook, model endpoint, or data service can become reachable while its access rules are still being reviewed. Add the observed source list at the edge of that service so scanner addresses do not have to be copied from logs by hand. Keep customer and developer access rules separate from the feed. Supporting data services may serve other workloads too, so check their required connections before applying a block.
The challenges
Scanning can reveal a reachable service before an exploit attempt, whether a flaw is known or still undisclosed. Our sensors record sources doing that probing. A firewall rule using the feed can deny a listed source before its next connection reaches your service, without needing to recognize the exploit itself.
An unknown flaw can still be reached
An undisclosed weakness may sit behind an endpoint a scanner has already found. Waiting for a known exploit pattern may be too late.
Local logs come later
The feed can include sources our sensors saw testing similar services before they first appear in your workload logs.
Edge enforcement
Defend your edge
The feed loads matching rules into your firewall. Listed sources are intercepted before crossing the edge; traffic with no match continues to your services.
Where this feed fits
Use the observed source list where your existing edge controls meet these reachable services.
Review scanner sources at the edge of a public model service. Customer and developer access still follows the rules set for that endpoint.
Apply the list in front of reachable notebooks. They often need a narrower access rule than the model service itself.
Use the feed around exposed search and vector data interfaces. Check which applications need access before blocking a source.
Review the list at reachable container and workload management interfaces. Administrator access should stay limited to approved networks.
Apply an edge rule where a data service used by an AI workload is exposed. The same service may support other workloads, so review its connections first.
Use the list around externally reachable dashboards that show workload data. Keep dashboard sign in and permissions in place.
Industry blocklist
Start blocking observed scanner sources.
Choose this industry, connect the feed to your firewall, and review access with the people who run each service.