ACL Curated Blocklists#1602
Open
avanscoy wants to merge 3 commits into
Open
Conversation
avanscoy
added
the
main-docs
avanscoy
added
the
DO NOT MERGE
Contributor
Summary
|
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
hazel-nut
reviewed
Jul 22, 2026
| @@ -0,0 +1,121 @@ | |||
| --- | |||
| title: Use Curated Blocklists in Tenant Access Control Lists | |||
| description: Use Auth0-managed curated IP blocklists in Tenant ACL rules to automatically block known threats without manually maintaining IP ranges or ASNs. | |||
Contributor
There was a problem hiding this comment.
Suggested change
| description: Use Auth0-managed curated IP blocklists in Tenant ACL rules to automatically block known threats without manually maintaining IP ranges or ASNs. | |
| description: Automatically block known threats without manually maintaining IP ranges or ASNs by using Auth0-managed curated IP blocklists in Tenant ACL rules. |
i like how it reads to put the impact (rather than the method) first, especially since the method is in the page title, but it's just a personal preference :)
|
|
||
| ### Combine with other matchers | ||
|
|
||
| Curated lists can be combined with CIDR blocks, ASNs, or geolocation matchers in the same ACL rule: |
Contributor
There was a problem hiding this comment.
Suggested change
| Curated lists can be combined with CIDR blocks, ASNs, or geolocation matchers in the same ACL rule: | |
| You can combine curated blocklists with CIDR blocks, ASNs, or geolocation matchers in the same ACL rule: |
Comment on lines
+112
to
+115
| ## Key capabilities | ||
|
|
||
| - **Automated updates**: Auth0 Threat Intelligence continuously updates all `auth0.*` list feeds, requiring no manual rule updates on your end. | ||
| - **Unified matching**: The `auth0_managed` matcher handles underlying complexity — such as mixing IPv4, IPv6, and TLS fingerprints — transparently within a single array. |
Contributor
There was a problem hiding this comment.
this is good info! maybe more useful integrated into the intro? i feel it's a little hidden after the instructions down here
|
|
||
| ### Exclude curated list traffic | ||
|
|
||
| Use `not_match` to explicitly allow traffic that is not on a curated list, for example to allowlist clean traffic while a broader blocking rule is in effect: |
Contributor
There was a problem hiding this comment.
Suggested change
| Use `not_match` to explicitly allow traffic that is not on a curated list, for example to allowlist clean traffic while a broader blocking rule is in effect: | |
| Use `not_match` to explicitly allow traffic that is not on a curated blocklist. For example, you can allow traffic not flagged as low reputation while a broader blocking rule is in effect: |
should this example also include a broader blocking rule? i get how not_match works but i think i'm not sure about the use cases for two rules 🤔
Comment on lines
+12
to
+14
| Curated Blocklists extend Auth0 [Tenant Access Control Lists (ACLs)](/docs/secure/tenant-access-control-list) with dynamically updated threat intelligence lists maintained by Auth0. Instead of manually maintaining IP ranges or Autonomous System Numbers (ASNs), you can reference pre-defined curated categories in your Network ACL rules. | ||
|
|
||
| When traffic matches any entry in an enabled curated list, Auth0 automatically executes the action defined in your ACL rule, such as blocking the request. |
Contributor
There was a problem hiding this comment.
Suggested change
| Curated Blocklists extend Auth0 [Tenant Access Control Lists (ACLs)](/docs/secure/tenant-access-control-list) with dynamically updated threat intelligence lists maintained by Auth0. Instead of manually maintaining IP ranges or Autonomous System Numbers (ASNs), you can reference pre-defined curated categories in your Network ACL rules. | |
| When traffic matches any entry in an enabled curated list, Auth0 automatically executes the action defined in your ACL rule, such as blocking the request. | |
| Auth0 curates blocklists for several threat intelligence categories, like low reputation IPs and TOR exit nodes, which you can reference in your [Tenant Access Control List (ACL)](/docs/secure/tenant-access-control-list) rules. | |
| When traffic matches any entry in an enabled curated blocklist, Auth0 automatically executes the action defined in your ACL rule, such as blocking the request. | |
| You can use our dynamically updated blocklists instead of manually maintaining IP ranges or Autonomous System Numbers (ASNs), or combine our blocklists with other CIDR blocks, ASNs, or geolocation matchers. |
suggestion to mention the ability to combine blocklists with other selectors since i think that's good to have up front
Comment on lines
+16
to
+20
| ## Available curated lists | ||
|
|
||
| Auth0 organizes curated lists into broad categories using standard naming conventions. All curated lists use the `auth0.<category>` prefix: | ||
|
|
||
| | List identifier | Category | Description | |
Contributor
There was a problem hiding this comment.
Suggested change
| ## Available curated lists | |
| Auth0 organizes curated lists into broad categories using standard naming conventions. All curated lists use the `auth0.<category>` prefix: | |
| | List identifier | Category | Description | | |
| ## Available curated blocklists | |
| Auth0 organizes curated blocklists into broad categories using standard naming conventions. All curated blocklists use the `auth0.<category>` prefix: | |
| | Blocklist identifier | Category | Description | |
wdyt of using "blocklist" throughout? i feel it's clearer and more specific than just "list", and lets us be consistent
| "expanded": true, | ||
| "pages": [ | ||
| "docs/secure/tenant-access-control-list/configure-rules", | ||
| "docs/secure/tenant-access-control-list/configure-blocklist", |
Contributor
There was a problem hiding this comment.
Suggested change
| "docs/secure/tenant-access-control-list/configure-blocklist", | |
| "docs/secure/tenant-access-control-list/use-curated-blocklist", |
file rename suggestion, to match the page title
| @@ -0,0 +1,110 @@ | |||
| --- | |||
| title: Use Curated Blocklists in Tenant Access Control Lists | |||
Contributor
There was a problem hiding this comment.
Suggested change
| title: Use Curated Blocklists in Tenant Access Control Lists | |
| title: Use Curated Blocklists in Tenant Access Control Lists | |
| sidebarTitle: Use Curated Blocklists |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR is to introduce Curated Blocklists for Tenant Access Control Lists.
References
Testing
Checklist
CONTRIBUTING.md.