Configuring an attack defense policy