Filter outbound network traffic to allowed endpoints

You can see recommended egress block policy in the Recommendations tab for each job. This is based on observed traffic across multiple runs of the job.

Once you set these allowed endpoints in the workflow file, or in the Policy Store(Need to understand this more) and switch to using egress-policy:block

• Harden-Runner blocks egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4)

• It blocks DNS exfiltration, where attacker tries to send data out using DNS resolution

• Wildcard domains are supported, e.g. you can add *.data.mcr.microsoft.com:443 to the allowed list, and egress traffic will be allowed to eastus.data.mcr.microsoft.com:443 and westus.data.mcr.microsoft.com:443