https://community.cisco.com/t5/network-security/security-intelligence-feed-order-of-events/m-p/3897789#M18186 <P>We had a recent event take place in which an IP address of a web site was being actively blocked by TALOS Security Intelligence as a Malware site. We created a URL Object, added to whitelist, and the site continued to be blocked by IP address. Our only solution was to add the IP address to the global whitelist.&nbsp;</P><P>&nbsp;</P><P>Is this expected behavior? It seems backward to us, as websites sometimes change IP address. Does the FMC always read the IP Blacklist prior to the URL whitelist?</P> Fri, 21 Feb 2020 17:20:38 GMT twistedtechmike 2020-02-21T17:20:38Z https://community.cisco.com/t5/network-security/security-intelligence-feed-order-of-events/m-p/3897789#M18186 <P>We had a recent event take place in which an IP address of a web site was being actively blocked by TALOS Security Intelligence as a Malware site. We created a URL Object, added to whitelist, and the site continued to be blocked by IP address. Our only solution was to add the IP address to the global whitelist.&nbsp;</P><P>&nbsp;</P><P>Is this expected behavior? It seems backward to us, as websites sometimes change IP address. Does the FMC always read the IP Blacklist prior to the URL whitelist?</P> Fri, 21 Feb 2020 17:20:38 GMT https://community.cisco.com/t5/network-security/security-intelligence-feed-order-of-events/m-p/3897789#M18186 twistedtechmike 2020-02-21T17:20:38Z https://community.cisco.com/t5/network-security/security-intelligence-feed-order-of-events/m-p/3898620#M18197 <P>Yes - SI (IP) precedes SI (DNS and URL) in the FTD Order of Operations. That's because IP blacklist/whitelist can be done in advance of running through any SSL and Network Analysis policies as well as preprocessors - all of which consume additional resources on the sensor.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="FTD OOO.PNG" style="width: 999px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/42016i9A4DC9FCC88F05B1/image-size/large?v=v2&amp;px=999" role="button" title="FTD OOO.PNG" alt="FTD OOO.PNG" /></span></P> Sat, 27 Jul 2019 04:02:13 GMT https://community.cisco.com/t5/network-security/security-intelligence-feed-order-of-events/m-p/3898620#M18197 Marvin Rhoads 2019-07-27T04:02:13Z