topic Re: Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD in Network Security

Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD

p.costa — Fri, 26 Mar 2021 17:28:11 GMT

Hi all,

I would like to address a question that I could not find the answer in the documentation.

We have a Cisco FTD and we are asked to add an IP to the global black list. We are also using CIsco Security Intelligence. How can we check if the IP is already being blocked from The Cisco Security Intelligence and how its is categorized? (ex. CnC, attacker, etc.)

We could check if it's already block so could avoid blocking it manually.

Thanks for you help!

Re: Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD

manabans — Sun, 28 Mar 2021 02:48:55 GMT

Lookup feature can be used on FMC UI to identify Regional Information Registries (RIR) information (whois) for any IP address.

Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config-guide-v622/using_lookups.html

Re: Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD

Marvin Rhoads — Sun, 28 Mar 2021 14:17:45 GMT

You can either use the talosintellignece.com site for a quick check or else look at the actual SI feeds that have been downloaded to your device(s).

Both methods are described in more detail at the following blog post:

https://www.lammle.com/post/how-to-find-the-list-of-ip-url-and-dns-entries-in-the-cisco-firepower-feed/

Re: Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD

p.costa — Mon, 29 Mar 2021 07:28:08 GMT

Hi Marvin

thanks for your reply. I will try searching on the SI feeds that have been downloaded to my device. Unfurtunately I cannot find the oprion on the Talos portal to download the blacklist, maybe it was removed.

Best Regards,

Pier

Re: Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD

Marvin Rhoads — Mon, 29 Mar 2021 13:14:58 GMT

They have removed the ability to download the entire Talos blacklist but you can still check on individual addresses.

For example: https://talosintelligence.com/reputation_center/lookup?search=8.8.8.8

Note in the bottom right of the page the indication of whether the address is on the "Talos Security Intelligence Block List"

Re: Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD

p.costa — Thu, 01 Apr 2021 09:13:40 GMT

Thanks, that's very helpful. So I can consider that Talos Security Intelligence Block List and Cisco Security Intelligence are pretty much the same.

Re: Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD

Marvin Rhoads — Thu, 01 Apr 2021 17:00:38 GMT

Yes - that's correct

Re: Check If IP is already blocked by Cisco Security Intelligence on C

regz20 — Sat, 18 Nov 2023 02:27:27 GMT

So if I found the IP in Talos saying that it was added to their blocklist. Can I skip adding this IP to my manual list?