topic Re: How are security intelligence feeds applied? in Network Access Control

How are security intelligence feeds applied?

Chris Coates — Thu, 23 May 2024 13:49:15 GMT

Hi All, I've been trying to figure out how the security intelligence feeds are applied/used. On the FMC, if I go to Objects > Security Intelligence > Network Lists and Feeds, I can see the Global Block/Don't Block lists and then the 2 default Cisco feeds (Cisco-Intelligence-Feed, Cisco-TID-Feed).

When I go to Security intelligence within the Access Policy, I can see the global block lists in the networks list on the left, but the feed objects do not show up here. I also checked if they could be used as intelligence sources, but it doesn't seem so.

How do I apply/use these 'feed' type objects?

Re: How are security intelligence feeds applied?

MHM Cisco World — Thu, 23 May 2024 13:53:40 GMT

https://rayka-co.com/lesson/cisco-ftd-security-intelligence/

Check this' you need to go to object management to feed your list

MHM

Re: How are security intelligence feeds applied?

Chris Coates — Fri, 24 May 2024 09:30:35 GMT

Hi MHM, thanks for the response. It was actually the Rayka video that brought me here in the first place.

I can see the feeds in object management, but it is not clear where/how these feeds are used. If I go to the security Intelligence tab in the access control policy, they are not available for addition to the block list as a list from object management would be.