Use of the AbuseIPDB to block incomming connections

[zacekm]

Hello,
I would like to ask if it is possible to reject incoming connections on Ironport for IP addresses in the AbuseIPDB database? We currently block these IPs on the firewall, but it causes problems when tracking user connection issues.

Thanks

Regards,
Michal

[Ken Stieers · Accepted solution]

As far as I can tell, not easily.
ESA can use DNS black lists, or STIX/TAXXI... AbuseIPDB doesn't offer either.