This one is very interesting, we are currently evaluating this solution:
Syspeace works closely with Windows in order to detect possible threats at a optimal performance. Events in the event log are continuously monitored for any suspect behavior.
If an event is deemed as a threat to the system, Syspeace proceeds to the next level by checking against an internal rule base which simply blocks the IP adress and adds the rule to the Windows firewall.
A user can always add IP addresses to the Local Whitelist to, for example, prevent the blocking of any internal networks or temporarily add single PCs. This should be used with caution as any IPs in this list are deemed trustworthy by Syspeace and will always be ignored.
Any threats will be added to the Local Blacklist automatically by Syspeace. You can always review the blacklist and add or remove them as you see fit. We recommended however, that you do not make any changes to this list as you could accidentally pave way for an unknown hacker.
A key feature of Syspeace is the ability to block known globally blacklisted IP addresses preemptively. By choosing this option, Syspeace will import the Global Blacklist onto your client and act accordingly, adding all globally blacklisted IP addresses to the firewall ruleset at the push of a button.
Whenever an important event takes place, the service is started or stopped, rules are placed in or removed from the firewall or the communication status to the central license and global blacklist server is changed, Syspeace has the ability to send mail to the appropiate people in your organisation.
Getting emails when important event happens may be good but sometimes you would also like to get a summary. Syspeace compiles a daily report with all attack attempts on your system and sends you a message with the information.
Syspeace also compiles a weekly report in the same way.