Engineer

[jerry.shively1]

Does Cisco create Blacklist in WSA and ESA based on threat intelligence? If so how often?  Thanks

[Jernej Vodopivec]

ESA blocks sender with bad sender IP reputation (ESA creates query for every connection).

WSA blocks web transactions based on bad IP reputation of the web server (WSA receives databases updates periodialy - on evrey 3-5 minutes if I'm not mistaken).

All information is gathered from Cisco SIO: http://www.senderbase.org/