If I have a single IP that's trying a Denial of Service attack, how can I automatically have it banned/shunned? I go in and manually put it in a group of banned IP addresses, but I'd like for it to be done automatically, maybe if someone has 30 simultaneous connections. Cisco ASA.
I believe this would be possible using the ASAs threat-detection commands. For example using threat-detection you could setup scanning-threat and then use the shun command.
To further add to this - one implementation would be to create an object on the ASA that acts as a whitelist and then using threat-detection scanning-threat shun exception insert whitelist group object name you would be able to shun anything that is NOT in that whitelist. Please be aware that is not the exact syntax you will have to use the docs & ? to find the exact commands however its mostly the correct syntax.