I have a Cisco ISR 4431 with an extended ACL using network/service groups. One of my network object groups is called Abused_IP and I normally add in hosts/network which I suspect is doing port scanning etc when I go through my netflow analayzer. This is a manual and tedios task and this group keeps on growing. Im looking at using UTD and Ive got the eval of the security license activated for me to test out - securityk9 (ISR_4400_Security) 1 IN USE. Hoever I notice that it doesnt have to option of "utd threat-intelligence" under the UTD command. Its only th following options avaialbe:
engine UTD engine
threat-inspection UTD Threat Inspection (IPS/IDS) config modes
Done some research on the web and my plan is to use the Cisco Talos:
utd threat-intelligence
feed talos
update interval 1440 ! Update every 24 hours
THen configure my network object-group
object-group network Abused_IP
dynamic threat-intelligence feed talos
What other license do I need for this ? Anyway I can use the current options to achieve this ?
