About liying.liu

liying.liu · 01-27-2022

Experts! Any insights into the polling mechanism of ETF on ESA? Basically I would like to know if ESA actually stores the external threat feeds in the same database as the internal ones upon polling ETF sources, or stores in different database. If th...

liying.liu · 01-24-2022

We are aware that Cisco Talos has been continuously integrating public threat feeds into its own threat feed library as part of the built-in feeds on-prem ESA. Is there a way to know which threat feeds of which vendor are integrated? With this info, ...

liying.liu · 01-24-2022

Async OS 12.1 is used. The only entry provided to enable ETF for IP reputation check is through HAT. I have the need to filter out some traffic based on destination address, but couldn't find a way to add in the condition. Is it possible? Thanks!

liying.liu · 01-24-2022

Thanks, Ken!!

liying.liu · 01-24-2022

The 2nd solution sounds interesting, I will give it a thought! Thanks!ESA doesn't accommodate IP reputation check with ETF by way of content filter. ETF is only provided on HAT for IP reputation check. That is why 1st and 3rd solution wouldn't help.

liying.liu · 01-24-2022

I see..., thanks!Then Ken, would you be able to recommend some external threat feed sources, fintech or not?At the same time, if we can hear any feedback from Cisco employee as well, that would be great.

liying.liu · 01-24-2022

Thanks Ken. Probably not, since ETF mechanism is provided to IP reputation check only in HAT. I am able to define content filter to do, for example, domain reputation check with ETF and add the content filter to inbound policy, but not for IP reputat...

liying.liu · 01-24-2022

Thanks for the reply, SriramV! We are accommodating two departments which have 2 different domain name as destination address. ETF can only be applied to one department. When we perform domain, URL reputation check, we can define content filter with ...

Member Since	‎01-24-2022 08:38 AM
Date Last Visited	‎10-26-2022 12:36 AM
Posts	8
Total Helpful Votes Received	15

User Statistics

User Activity

Polling mechanism of External Threat Feed feature on ESA

Cisco Talos' integration of threat feeds from other vendors in ESA

Enable ETF for IP reputation check in HAT, filter out certain traffic

Re: Cisco Talos' integration of threat feeds from other vendors in ESA

Re: Enable ETF for IP reputation check in HAT, filter out certain traf

Re: Cisco Talos' integration of threat feeds from other vendors in ESA

Re: Enable ETF for IP reputation check in HAT, filter out certain traf

Re: Enable ETF for IP reputation check in HAT, filter out certain traf