How do you run a new intel block list in alert-before-block mode, and what decides enforcement?

## Why the trial exists A block list push lands directly in the traffic path, in every region, with no staged copy of the estate behind it to try first. Alert-before-block is the substitute for that missing staging: you run the exact same list against the exact same traffic, and let it tell you what it *would* have done before it is allowed to do it. ## Running it **Preferred:** load the list at the enforcement point in alert, monitor or log-only mode. The evaluation happens where enforcement will happen, so you also learn whether the list loads at all — whether it fits under the platform's entry ceiling, how long the compile and distribution take, and whether every region actually received it. **Fallback, when the platform has no alert-only mode for custom destination lists:** evaluate the same indicators against the records you already collect — proxy access logs, DNS query logs, flow records — off the enforcement path. You lose the load-and-push rehearsal but keep the collateral picture, which is the part that prevents outages. Either way, fix two things at the start: the **window** and the **decision date**. A trial with no end date becomes a permanent state where the list is neither enforced nor removed and nobody owns it. Two weeks is a common choice because it spans both weekday and weekend traffic, and choosing it to cover a month-end catches finance and payroll flows that are invisible mid-month. ## What to measure Count, per indicator: - **Matches** — how often it would have fired at all. - **Distinct internal sources** — one host or four hundred. One host is an investigation; four hundred is a business dependency you did not know about. - **The destination behind the match** — which hostnames sit on a matched address, from the proxy record. This is the single most valuable field, because it is what tells you whether the entry is aimed at one tenant or at a shared front end. - **A verdict per matched destination** — adversary, business, or unknown. Unknown is not a pass; it is work to do before the decision date. - **Regional variation** — a destination that is a rarity in one region and routine in another usually means a local business dependency, not a local infection. ## The counter-intuitive part The instinct is that a high hit rate means the list is valuable. Usually it means the opposite. An indicator matching tens of thousands of times across hundreds of hosts is very rarely a mass compromise you somehow missed; it is a CDN edge, a shared hosting address, a mislabelled feed entry, or an update service that some feed once saw abused. Enforcing it is scheduling an outage. So: - **Zero matches, sound provenance** → safe to enforce. The collateral risk is measured and low. Do not then claim the block prevented anything; it has simply not cost anything yet. - **A few matches from few hosts** → investigate each before enforcing. These are the entries that either become an incident or become an allow-list entry. - **Very many matches from many hosts** → do not enforce until you can explain it. Look at the hostnames behind the address; if they are business services, the entry belongs on the allow-list, not in the block list. ## Deciding, and rolling out Enforcement is a decision about collateral, not about confidence in the feed. The entries that go live are those you can say a sentence about: 'no internal host has contacted this in fourteen days', or 'the four hosts that contacted this are the ones already in the incident'. Everything else waits. Then roll out by region rather than everywhere at once, with a watch window between regions. The first region is your last chance to discover a dependency that only exists in one office, and it caps the blast radius of anything the trial missed — a destination that simply had no traffic during the window, but does at quarter-end. ## What the trial cannot tell you It measures collateral, not efficacy. Two quiet weeks say the list is cheap to enforce; they say nothing about whether it will ever stop anything, and nothing about the destinations the adversary has not used yet. Treat the output as a licence to enforce safely, never as evidence that enforcing was worthwhile.