topic Re: how to import bulk ip addresses or domains to spark 1900 using smartconsole ? in Firewall and Security Management

how to import bulk ip addresses or domains to spark 1900 using smartconsole ?

JChang — Fri, 13 Mar 2026 00:59:04 GMT

Hi Guys,

I want to know how to import bulk ip addresses or domains to spark 1900 using smartconsole. Could you please provide documents for my reference ?

Thanks a lot.

Jeremy

Re: how to import bulk ip addresses or domains to spark 1900 using smartconsole ?

Chris_Atkinson — Fri, 13 Mar 2026 01:28:02 GMT

To use as objects in the firewall policy? or to use as IOCs e.g.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ThreatPrevention_AdminGuide/Content/Topics-TPG/Importing-External-Custom-Intelligence-Feeds-in-SmartConsole.htm?tocpath=Common%20Features%20in%20Custom%20Threat%20Prevention%20and%20Autonomous%20Threat%20Prevention%7CConfiguring%20Threat%20Indicators%7CImporting%20External%20Custom%20Intelligence%20Feeds%7C_____2

Re: how to import bulk ip addresses or domains to spark 1900 using smartconsole ?

JChang — Fri, 13 Mar 2026 01:32:40 GMT

Hi Chris

Thank you for your reply. What can I do if I want to use the object in the firewall policy ?

Re: how to import bulk ip addresses or domains to spark 1900 using smartconsole ?

JChang — Fri, 13 Mar 2026 01:56:32 GMT

I find the External Network Feed function can import IP addresses or Domain from the external server using Plain list. What kind of file format supported for this plain list ?

Re: how to import bulk ip addresses or domains to spark 1900 using smartconsole ?

Chris_Atkinson — Fri, 13 Mar 2026 02:35:57 GMT

Use the API to import objects from a CSV file e.g.

CLI API Example for exporting, importing, and dele... - Check Point CheckMates

Re: how to import bulk ip addresses or domains to spark 1900 using smartconsole ?

Vincent_Bacher — Fri, 13 Mar 2026 10:38:47 GMT

This is a text file either as flat list or json and in the config of the external feed you define either the delimiter of the flat list or jq query to parse the json structure.
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/Network_Feed.htm

Use Case: If you use zscaler you can directly download a json with objects from them
https://config.zscaler.com/api/zscaler.net/cenr/json
then you tell your network feed how to parse it. Here for this use case the jq query:

."zscaler.net"[] | .[] | .[] | .range

That's it.
The feature then retrieves the json and converts it to a simple list, same as if you chose flat list as format.
Just simulated it on the cli to demonstrate:

Flat list is easy. Just a list with one object per line.
So would look somewhat like this if you choose IP as type

# Blocked IP addresses - updated daily # Last update: 2025-03-13 1.2.3.4 10.0.0.0/24 192.168.1.1-192.168.1.50 malicious-domain.com *.bad-example.org 203.0.113.5 198.51.100.0/24