topic Re: FMC Feed through online csv file in Network Security

FMC Feed through online csv file

Frank Osberg — Sat, 18 Dec 2021 12:27:14 GMT

Hi all

So I can see on github that there are list from MS sentinel that contains a lot of ipes that are trying to gain access for log4j...

The list gets updated all the time, but is there a way where I can make a security intelligence feed that keeps the list updated.

So I tried to make a list feed under Network Lists and Feeds - But I am getting a error 400 Bad request.

The link I a trying feed is :

Log4j-IP-Blocklist

This is how I have made the Feed in my FMC:

This shoud be right if the feed can do a csv file feeds correct??

Is there another way to fix this? 🙂

Frank

Re: FMC Feed through online csv file

rhuysmans — Sun, 19 Dec 2021 21:53:59 GMT

Hi,

I used the full URL and it seemed to work ok, ie no error msgs.

https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/Log4j_IOC_List.csv

Give it a try.

Merry Christmas.

Re: FMC Feed through online csv file

Frank Osberg — Sun, 19 Dec 2021 22:19:58 GMT

Hi,

It is the same link as mine right? I just made i short here in my question, and the picture only shows the first... But i will try again.

Frank

Re: FMC Feed through online csv file

rhuysmans — Sun, 19 Dec 2021 22:30:31 GMT

I believe so as I clicked on your link and the list popped up.
I then created a feed in my test FMC, running 7.1.0, and it worked first go.
I created a rule using the feed and that went through as well with no problems.

Cheers.

Re: FMC Feed through online csv file

Frank Osberg — Mon, 20 Dec 2021 07:52:41 GMT

Hi @rhuysmans

Funny tried it again and now it works. 🙂

Great stuff.. Thanks for your help mate.

Have a Merry Christmas

Frank