> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aegister.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How It Works

> How ATB operates: series and parallel modes for different perimeter protection needs.

Aegister Threat Blocker (ATB) runs in two modes, each for a different perimeter security need.

## 1. Series Mode

Use series mode when you have no other perimeter protection device.

* **Placement:**\
  ATB sits in line with the corporate gateway and acts as the **primary firewall**.

* **Configuration:**\
  The device runs on PFSense and includes:
  * Security rules for full enterprise protection.
  * Aegister's threat intelligence for real-time analysis.
  * A built-in VPN for remote maintenance and updates.

This setup centralizes security, making ATB your single point for traffic control and protection.

## 2. Parallel Mode

Use parallel mode when you already run a firewall (Sophos, Fortigate, SonicWall). Most organizations choose this mode.

* **Placement:**\
  ATB runs alongside the main firewall.

* **Functionality:**\
  In parallel mode the device does two jobs:
  * **Threat intelligence:**\
    ATB feeds security updates and threat data to the primary firewall, sharpening its detection and prevention.
  * **Optional log mirroring:**\
    ATB can mirror logs so the Aegister Cyber Console shows the latest 10M events and the IP addresses our threat intelligence blocked. This gives you detailed visibility and control over security operations.
  * **Built-in VPN:**\
    Provides remote access for maintenance and updates.

## Conclusion

Pick the mode that fits your organization:

* **Series mode:** A centralized, integrated security solution when no other perimeter device is present.
* **Parallel mode:** Adds ATB's capabilities to an existing firewall, improving security and monitoring through log mirroring.

Choose the mode that fits your environment to get the most from Aegister Threat Blocker.