Traffic Classification

Traffic Classifications define the internal IP address blocks and domain names for your organization. This is an important configuration step for Fusion, as understanding internal vs external communication is used within detection models and for helping understand traffic flows in the Fusion Portal.

Internal Networks

In Settings > Traffic Classification, the Network tab lets you define IP blocks associated with your internal networks.

You can also enable Private Networks to have RFC1918 address space automatically included as part of your internal network.

Internal Domains

In Settings > Traffic Classification, the DNS tab lets you define internal domains associated with your organization.

Once you have configured a traffic source for DNS in Fusion, you should also set the Internal Domains for your organization. This will mark DNS queries to internal domains as internal in Fusion.