topic Re: IOC import in Firewall and Security Management

IOC import

Milica_Spasic — Fri, 14 Sep 2018 12:33:50 GMT

Hi,

I have tried to import IoC downloaded from IBM xforce exchange web site in order to prevent some malicious activities, but if had failed. I'm using stix format (example file is attached). I receive following error:

Our management is on 80.20 version.

Any idea what couses the problem?

Kind regards,

Milica

Re: IOC import

PhoneBoy — Sat, 15 Sep 2018 00:31:17 GMT

Is it the R80.20 EA or R80.20.M1?

Anyway, the errors seem to be somewhat obvious:

Several fields in the XML file aren't supported by us--those are ignored.
Since confidence, severity, and product aren't included in this XML (which we use), we specify defaults.
From this file, it seems we cannot determine the IOCs, or it's not in the format we expect.

Assuming it's R80.20.M1, I would open a TAC case.

Re: IOC import

Milica_Spasic — Sat, 15 Sep 2018 05:58:12 GMT

Thank you, Dameon. I saw that some filds were not supported. But was confused where is the exact problem, because they file should be standardized.

We will open the case.

Regards,

Milica