Curated blocklists integrate threat intel into Tenant ACLs

Overview

Curated Blocklists extend Auth0 Tenant Access Control Lists (ACLs) by integrating dynamically updated threat intelligence directly into your Network ACL rules.

Instead of manually tracking and updating individual IP ranges or ASNs, Attack Protection customers can delegate IP risk management to Auth0 Threat Intel, ensuring continuous, automated protection against evolving threat vectors.

Available Categories

Referencing curated categories using the auth0.<category> prefix allows precise blocking based on traffic origin:

• auth0.low_reputation: High-risk IP addresses identified as active threat vectors or origin points.
• auth0.tor: Active TOR exit nodes.
• auth0.proxy: Residential, data center, or public proxies.
• auth0.vpn: Commercial Virtual Private Network (VPN) providers.
• auth0.icloud_relay_proxy: Egress nodes for Apple iCloud Private Relay traffic.

API Request Structure

To configure curated lists, pass the desired identifiers in the auth0_managed array within the match object of your rule definition:

POST /api/v2/network-acls
{
  "description": "Block low-reputation IPs",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation"
      ]
    },
    "scope": "authentication"
  }
}

Configuration & Exception Handling

Configure curated blocklists via the Network ACLs Management API inside the auth0_managed matcher block. We recommend testing each category in your environment prior to enforcement. If a curated list blocks a legitimate user or IP, configure a higher-priority ACL rule that executes ahead of the managed list to explicitly allow the traffic.

For setup guides and details on Curated Blocklists and Tenant ACLs, check these links:

• Use Curated Blocklists
• Configure Tenant ACLs