New VisionHeight threat-intel rules join AWS Network Firewall!

Hi everyone, it's me, Shiichan! Today I've got news about some new helper rules landing in your firewall.

AWS What's New aws.amazon.com

What was announced?

From AWS What's New: AWS Network Firewall now supports two new managed rule groups from VisionHeight. Both are available through AWS Marketplace, and they're called "Zero-Day Threat Protection" and "Noisy Scanners and Tor Protection." They give you access to proprietary threat intelligence built on VisionHeight's Pulse telemetry.

The story so far

Managed rules for Network Firewall were already offered by sellers like Check Point, Fortinet, Infoblox, Lumen, Rapid7, ThreatSTOP, and Trend Micro. This update simply adds VisionHeight to that lineup.

What changes

Zero-Day Threat Protection proactively blocks malicious IP infrastructure before it shows up on public blocklists. The announcement says:

This rule group helps organizations get ahead of emerging threats by weeks

So the goal is to stay ahead of emerging threats, which is handy for workloads facing targeted attacks.

The other one, Tor Protection, blocks communication with active Tor exit nodes and filters traffic from known high-volume scanning sources, which cuts down on firewall log noise.

Dive Deep

Tor Protection refreshes daily and suppresses noise at the first packet, before events are even generated. That means lower SOC alert volume, reduced SIEM ingestion costs, and Tor removed as a path into or out of your environment, all in one go.

To get started, you can head to the AWS Network Firewall console or browse the managed rules in AWS Marketplace. For the full list of supported regions, check the AWS Regional Services page. If you want the details, the service documentation is a good entry point.

Wrap-up

• AWS Network Firewall now supports two VisionHeight managed rule groups (via AWS Marketplace)
• Zero-Day Threat Protection blocks malicious IPs before they hit public blocklists
• Tor Protection tamps down Tor exit nodes and scanners to reduce log noise and ease SOC/SIEM load
• A small but useful update for teams looking to cut security noise and react faster!