Block List Data Source in Cisco AMP

[pavankumar.kakarla]

What is the source that Cisco is referring to block the IP address under "Network" tab, Where can we find the source for this so that we can customize if required.

[Matthew Franks]

AMP uses a subset of the TALOS Intelligence IP Blacklist.  To create your own list, you can go to Outbreak Control > IP Block & Allow Lists.  Once your list is created, go to edit your policy and add it in the Outbreak Control section.

Under Advanced Settings > Network, you can choose to use Cisco's list, Cisco and Custom, or just your Custom lists.

Thanks,

Matt

[pavankumar.kakarla]

Thanks Matthew, So is this list dynamically updated by Cisco based on new threats. Is my understanding right?

[Matthew Franks]

That is correct.  The list is regularly updated by TALOS.

Thanks,

Matt