MDE Administration

Managing Indicators

Adding Indicators

Indicators can be added to the MDE Domain Indicator List—and subsequently blocked by MDE—through any of the following five methods:

Blocking must be enabled for it to function. See above under ‘Step - 3 Blocking Mode (OPTIONAL)’ it order to configure blocking.

1. HYAS Protect Decision Engine: The Decision Engine dynamically assigns a block verdict to a query, which is then reflected in the MDE Domain Indicator List.

2. Categories: Blocked categories configured in HYAS Protect are mirrored as blocks in MDE.

3. Rules: Custom rules created by your organization will be applied in MDE as blocks.

4. Lists: Indicators from HYAS lists outside of the MDE List are automatically passed along to the MDE Domain Indicator List.

5. Manual Entry: Users have the option to manually add indicators directly to the MDE Domain Indicator List in HYAS Protect.

Removing Indicators

Indicators added to the HYAS Protect MDE Block list can be removed in three ways:

1. Manually via MDE: If you wish to remove indicators from the MDE Domain Indicator list, you may do so by navigating to your MDE Domain Indicator List and deleting accordingly.

   1. This will update the HYAS Protect MDE list.

2. Manually via HYAS Protect: Login to HYAS Protect>Protect List Management>MDE

   1. Select the indicator(s) you wish to delete.

   2. Click on the Trash Can icon towards the top of the page.

   3. This will update the MDE Domain Indicator list accordingly.

When removing an indicator, whether through HYAS or MDE, it’s crucial to also remove it from any lists or rules it belongs to. If you don’t, HYAS will re-add the indicator to the MDE Domain Indicator List, causing it to be blocked again. 

Similarly, if the indicator was blocked by the Decision Engine or a Category block, you must add it to an allow list. Failing to do so will result in the indicator continuing to be blocked.

3. Automatically: To help manage the size of your MDE Domain Indicator List, HYAS Protect automatically removes indicators from the MDE List that were added by the Decision Engine if they haven’t been detected in traffic for 180 days. This is by default and non-configurable.

   1. If you wish to continue to block these queries after the 180 days, you must add said indicators to a static (non MDE) block list prior to the 180 expiration.

   2. This effects ONLY the indicators added by the Decision Engine. If added via category, rules, other list or manually, the queries will not expire.

HYAS Protect automatically removes indicators from the MDE List that were added by the Decision Engine if they haven’t been detected in traffic for 180 days. For more details, please refer to the information above.

FAQs

Q: How does HYAS Protect handle domains that are on allow lists or already blocked in MDE?

• If a domain is already on the MDE block list, you must add it to an allow list in HYAS Protect and then manually remove it from the MDE list.

• If a domain is on an allow list before HYAS sees it, HYAS will not add it to the MDE block list, because HYAS only sends blocks, not allows, to MDE.