Check If IP is already blocked by Cisco Security Intelligence on Cisco FTD

[p.costa]

Hi all,

I would like to address a question that I could not find the answer in the documentation.

We have a Cisco FTD and we are asked to add an IP to the global black list. We are also using CIsco Security Intelligence. How can we check if the IP is already being blocked from The Cisco Security Intelligence and how its is categorized? (ex. CnC, attacker, etc.)

We could check if it's already block so could avoid blocking it manually.

Thanks for you help!

[manabans]

Lookup feature can be used on FMC UI to identify Regional Information Registries (RIR) information (whois) for any IP address.

Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config-guide-v622/using_lookups.html

[Marvin Rhoads · Accepted solution]

You can either use the talosintellignece.com site for a quick check or else look at the actual SI feeds that have been downloaded to your device(s). 

Both methods are described in more detail at the following blog post:

https://www.lammle.com/post/how-to-find-the-list-of-ip-url-and-dns-entries-in-the-cisco-firepower-feed/

[p.costa]

Hi Marvin

thanks for your reply. I will try searching on the SI feeds that have been downloaded to my device. Unfurtunately I cannot find the oprion on the Talos portal to download the blacklist, maybe it was removed.

Best Regards,

Pier

[Marvin Rhoads]

They have removed the ability to download the entire Talos blacklist but you can still check on individual addresses.

For example: https://talosintelligence.com/reputation_center/lookup?search=8.8.8.8

Note in the bottom right of the page the indication of whether the address is on the "Talos Security Intelligence Block List"

[p.costa]

Thanks, that's very helpful. So I can consider that Talos Security Intelligence Block List and Cisco Security Intelligence are pretty much the same.

[Marvin Rhoads]

Yes - that's correct

[regz20]

So if I found the IP in Talos saying that it was added to their blocklist.  Can I skip adding this IP to my manual list?