Skip to main content

Verdicts

Updated

The Verdicts page in Shield lists the domains Shield has stored a classification for — one row per domain — with the verdict it reached, the engine tier that decided it, the category, and a confidence score. It is where you audit why a domain was allowed or blocked and test a domain on demand.

This list is not every domain Shield has resolved. Shield's verdict store is written only when a domain reaches the Tier-3 crawl, so the page shows the crawl record: Tiers 0–2 answer from the resolver's cache and are never written here. A domain you just resolved in the Test a domain box may therefore be missing from the list below — that is expected, not a failure. The store is also shared and domain-level: one row per domain, not per client or device.

This article covers reading the verdicts list, filtering it, and testing a domain.

Opening Verdicts

Go to Verdicts in the Shield nav (app.theonestack.com/shield/verdicts). The page subtitle reads "Cached classifications from the verdict store, and only domains that reached a Tier-3 crawl are stored here." The table lists recent verdicts with these columns:

  • Domain — the resolved domain.
  • Verdict — the decision (see below).
  • Category — the content/threat category (for example malware, phishing, social_media).
  • Tier — which layer of the verdict engine decided it (0–4).
  • Confidence — how confident the engine is, as a percentage.
  • Expires — when the stored verdict lapses. A lapsed verdict is labelled "Expired N ago"; an expired verdict is not the current state of the world.
  • First seen — the first time Shield recorded this domain. It is not updated when the domain is re-resolved.

Above the table the counts read shown, live, expired, and withheld. "Withheld" is the number of platform-infrastructure hostnames Shield keeps out of this view.

Verdict Values

Verdict Meaning
Allow Domain is permitted
Allow + monitor Permitted, but resolutions are logged for monitoring
Block Domain is blocked
Uncertain The engine could not reach a confident verdict

These four are the only values the verdict store can hold. warn is not one of them — it is the DNS wire response Shield returns for Allow + monitor, and it is never stored as a verdict. Review is not a verdict of this store either.

How the Verdict Engine Decides (Tiers)

Shield uses a layered engine. A domain gets the cheapest confident answer:

Tier What decides it
Tier 0 Instant allow/block from the cached verdict, your global, MSP, and client allow/block lists, and cross-MSP fleet consensus
Tier 1 Detection rules plus live threat-intel feeds (URLhaus, ThreatFox, and others)
Tier 2 Fast AI name assessment
Tier 3 Live crawl plus a final AI verdict with evidence
Tier 4 SCOUT escalation for novel threat infrastructure

Confident verdicts are cached, so the next lookup of the same domain answers instantly from Tier 0. A cached verdict is not written to the Verdicts list — only a domain that reached the Tier-3 crawl is. To force a domain to a specific outcome regardless of the engine, add it to an allow or block list (see Allow and Block Lists) — list entries are Tier 0 and override the AI tiers.

Filtering the List

Use the controls above the table:

  • Filter by domain — type a domain (or part of one). This is a substring search, so github matches github.com.
  • Verdict filter — All verdicts, Allow, Allow + monitor, Block, or Uncertain.
  • Freshness — All verdicts (live + expired), Live only, or Expired only.
  • Category — pick from the categories that exist in the store, e.g. malware.

The result count updates as you filter.

Testing a Domain

To check what Shield would do with a domain right now:

  1. In the Test a domain box, enter a domain (for example example.com).
  2. Click Resolve (or press Enter).
  3. Shield runs the live lookup and shows the verdict, tier badge, confidence percentage, and category.

This is the quickest way to confirm whether a domain is currently allowed or blocked, and why.

FAQ

A domain got a verdict I disagree with — how do I override it? Add it to your allow or block list. List entries are Tier 0 and take precedence over the AI tiers, and they answer instantly on the next lookup.

Why is the same domain sometimes a different tier? The first time a domain is seen it may go through higher tiers (crawl/AI). Once a confident verdict is cached, subsequent lookups return from Tier 0.

What does "Allow + monitor" mean? The domain is permitted, but its resolutions are logged so you have visibility — useful for categories you want to watch without blocking.

Related