Manage Lumen Defender Plus Threats and Blocking Rules

The Security tab brings Lumen Defender Plus into Apptifi. It shows the threats Lumen sees against your services, lets you decide which addresses to trust or block, and controls who gets alerted. Everything is organized into six areas across the top: Event Logs, Activity Logs, Custom Lists, Blocking Rules, Notifications, and Filters. In the top corner, a badge shows your Defender service level.

Premium Active means you can view everything and make changes. If your service is read-only, you can still see all the threat data, but changes to lists, blocking rules, and notifications are locked. Let's start with Event Logs, the threat events Lumen recorded for your service. Pick a From and To date, then click Fetch Logs.

Each row is one event. You'll see when it happened and the address involved, whether the traffic was blocked or still active, the protocol, and the threat category. The risk level runs from low up to severe. You also get the source and destination addresses, the country the threat came from, and whether the address is on one of your lists.

Need it in a spreadsheet? Click Download CSV. Activity Logs are the audit trail for your Defender settings. Fetch them the same way, and you'll see who added or removed an address, or changed a notification, and when they did it.

Custom Lists let you decide how specific addresses are treated. Use the Allow List for addresses you trust, the Deny List for addresses you always want blocked, and the Monitor List for addresses you want to keep an eye on. To add one, open the list, click Add IP, then enter the address and an optional note explaining why. Click Add to save it.

Each entry shows its risk, your note, and who added it, and you can edit the note or remove the entry from the row. Blocking Rules set how aggressively Lumen blocks threats automatically. Choose No Blocking, block only Severe threats, or widen it to include Very High and High risk. Your current rule is highlighted.

Pick a new one and click Update Blocking Rule to apply it. Notifications send email alerts, for example when a new threat appears or a threat score increases, filtered by risk level. Click Add Notification to subscribe another address, or remove one you no longer need. Finally, Filters lists the values Lumen uses to describe events: categories, risk levels, protocols, statuses, products, and list names.

It's a handy reference when you're reading the logs. That's Security. Review events and activity, manage your allow, deny, and monitor lists, set your blocking rule, and choose who gets alerted. Next, we'll walk through Settings.