External Threat Feeds Sourses

[mvs_system]

Hi

Is there any another External Threat Feeds except the "https://otx.alienvault.com/" that I can configure that is free?

doron

[Kasun Bandara]

i guess this will help. cisco talos can use for your requirement

https://socradar.io/the-ultimate-list-of-free-and-open-source-threat-intelligence-feeds/

[balaji.bandi]

i use open-source SIEM and use MISP works as expected :

https://www.misp-project.org/ and www.blocklist.de

[mvs_system]

Hi can I configure it in the ironport: Hostname, Source Name,Collection Name and more of each of those?

thanks

doron 

[balaji.bandi]

we are still not sure what you trying to do here.

are you looking to replace webroot or any other feed with open source feed to validate the URL ? ( never used any 3rd party, AMP does a good work with Talos )

check Async OS has that option :

https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa_14-0/User-Guide/b_WSA_UserGuide_14_0/b_WSA_UserGuide_11_7_appendix_010111.html#con_1298416

[mvs_system]

I want to add more TAXII resources to the ironport like "https://otx.alienvault.com/".

is this is the only external feeds that I can configure with ironport?

[balaji.bandi]

i was not sure - may look at the external routing example - is this work?

https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/118141-troubleshoot-wsa-00.html