Checking blacklist IP in Security Intelligence Feed

[mahesh18]

Hi Everyone,

I read that Security Intelligence Feed download IPs that have bad reputation from Sourcefire cloud.

But when I click on Security intelligence feeds I see no IP address.

Does anyone can please tell me where I can find blacklist IP's ?

Regards

MAhesh

[adhogan · Accepted solution]

The security intelligence data is considered proprietary and so the content of those lists is not made public.

[mahesh18]

Many thanks for answering the question.

[a.cochran · Accepted solution]

You can view the list of Security Intelligence IP addresses from the CLI of the Defense Center. You'll want to issue the following commands after logging in:

1. sudo su

2. cd /var/sf/iprep_download

In this directory, there is a file called rep_dd.yaml. You can view this text file to find the UUID associated with each category, such as "attackers".

There should be a file in the /var/sf/iprep_download directory named for that UUID, for example 5a0b6d6b-e2c3-436f-b4a1-48248b330a26. You can view this file using the "less" command in order to see the IP addresses that are currently included for that particular category.

[mahesh18]

Many thanks Cochran for answering the Question.

I will test this.

Regards

Mahesh

[cunningpike]

You can find out which Security Intelligence List/Feed an IP address is listed in (if any) with the following command on the CLI of the DC:

grep -A2 $(basename $(grep -l $1 /var/sf/iprep_download/*)) /etc/sf/iprep_sources.conf

CP