It means that the NGAF device is connected to the cloud, actively downloads the hacker IP address in the cloud, and synchronizes it to the local host to protect the business assets against the intrusion from the hacker IP addresses added to the protection list. When the traffic from the hacker IP addresses passes NGAF, the source IP address that matches successfully will be automatically blocked. In case of false positives, you can unblock the IP address. Once unblocked, the cloud hacker IP database will no longer block this IP address. The cloud hacker IP database is automatically updated every 2 hours to obtain the latest intelligence.

In case of false positives, you can check the corresponding IP address and click Unblock. Then, in the displayed Confirm window, click Yes to unblock this IP address as shown below:

You must connect the NGAF device to the Internet first before enabling the Hacker IP Database function.