Block RDP port on brute force detection - automatically blocks the default RDP Port (3389) on the endpoint where an audit breach is detected for both TCP and UDP. Once the RDP Port is blocked on an endpoint, you'll see a Blocked RDP icon in the Status column (in the Active Clients' view). To unblock the RDP Port, you have to select the endpoint in question and click on Unblock RDP Port from the dropdown menu. The Unblock RDP Port option will then be replaced by the Cancel Unblock RDP Port option, which cancels the Unblock RDP Port action. The RDP port is not getting blocked in case the BFAs are originating in the private network. The Unblock RDP Port option will not appear if the RDP port is not blocked.
Applying the Unblock RDP Port option will show the below notification:RDP Port - this field allows you to change the default RDP Port (3389) to another port number (in case of another RDP Port usage).
Allowlist - allows you to add an IP Address that is detected as a brute force attack and is considered a false positive;