• DETECTION
  • MITIGATION
  • AUDIT
  • REVIEW

How to block malicious IPs with your AI agent

Connect Wallarm to your agent to turn security logs into instant firewall updates.

Ask AI about this page

Short answer

How can I block malicious IPs using my AI?

Your agent scans Wallarm security hits to find attack sources and then creates new ACL rules to block them. This moves you from detection to mitigation without manual rule entry.

The outcomes of this task.

Where your security updates land.

What happens once you give your agent access to Wallarm.

DETECTION

Identified attack sources

The AI pulls specific IP data from your security logs. You get a clear list of the exact addresses causing trouble.

MITIGATION

Active IP blocking

The agent applies new access control rules immediately. This stops the malicious traffic at the edge.

AUDIT

Updated security state

Your ACL rules stay current with the latest threats. You can verify exactly which IPs are now restricted.

REVIEW

Human oversight

The AI presents the proposed blocks to you first. You decide if a rule should be applied or if an IP is a false positive.

The workflow

What your AI does when the attack arrives.

The agent handles the heavy lifting of finding and stopping bad actors.

  1. Find the attackers

    The agent looks through your recent security events to find high-risk IP addresses.

    search_security_hits

  2. Analyze the threat

    It evaluates the hits to determine which IPs are actually malicious and need blocking.

    search_security_hits

  3. Create the block

    Once you confirm, the agent writes a new rule to the access control list.

    create_ip_acl_rule

  4. Confirm enforcement

    The agent verifies the new rule is active in your security configuration.

    create_ip_acl_rule

Try it

Copy these to start.

Use these prompts to trigger the Wallarm workflow.

Starting points

These are starting points. Swap out the specific IP or timeframe to match your current incident.

Wallarm Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_wtqoTiRGf7f9vV5ladmPTVkzskQH77LY6DMZ7ltz/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Wallarm capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "wallarm-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_wtqoTiRGf7f9vV5ladmPTVkzskQH77LY6DMZ7ltz/mcp"
    }
  }
}
Copy into chat04

  • Find the most recent malicious IP addresses from my Wallarm security hits.

  • Create an ACL rule to block the IP address 192.168.1.100.

  • Which IPs from the last hour should I block in Wallarm?

  • Check my Wallarm security hits and suggest which IPs need an ACL rule.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Wallarm once, then ask.

Just link your account once. Your credentials stay encrypted, and you can start running security tasks immediately.

Connect Wallarm to your AI

FAQ

How this task behaves.

  • 01

    Will the AI block IPs automatically without asking me?

    No. The AI identifies the threats and proposes the rules, but you must give the final command to apply a block.

  • 02

    Can the AI delete existing ACL rules?

    No. This connector only has the capability to create new rules via create_ip_acl_rule.

  • 03

    How does the AI know which IPs are malicious?

    It uses the data returned from search_security_hits to identify addresses that triggered security events.

  • 04

    Can I use this to scan for vulnerabilities?

    No. This specific task is for identifying hits and managing IP access control rules.

  • 05

    Does the AI have access to my full Wallarm dashboard?

    The AI only sees the data it needs to perform the specific tools you ask it to use.

  • More questions about Wallarm? The Connector page answers them. See everything the Wallarm Connector can do

Connect Wallarm to Claude, Cursor, ChatGPT & more