External IOC - Log questions

Scottc98 — Fri, 30 Jun 2023 21:57:02 GMT

Hello,

I've been testing out some external IOCs for a production rollout and was hoping to get some understandings on some of the log messages. I have 3 feeds running for testing: one IP host list, one url list and one domain list.

When looking at "blade:Anti-Virus AND type:Control" in smartconsole, I get these logs under the 'forensics Details => Description" and what my understanding is:

External IOC - Fetch succeeded
- I know that the configs are setup to fetch the feed every 5min but the log seems to show up only when there was an actual update to the feed txt/csv file on the remote server.
  - So....my understanding is when i see this message it means at least 1 of the 3 feeds had an update and such fetch is good.
External IOC - Partial success, IP_TEST: Success, URL_TEST: Success, DOMAIN_TEST: Feed format problem. Empty feed"
- I read this the same as the above message except that one of the feeds had a problem due to the feed having no domains listed (which was the test case). The other two feeds 'fetched'
External IOC - External Indicators processing failed
- This one seems straightforward to me as it detailed out that the processing failed and the reason.
  - Our reason was "Couldn't connect to server"; which is accurate during our testing and the remote server was down.
  - I also noticed that I got this message every 5 min; which solidifies that the GW was attempting updates within the defined interval.

So.....now my questions 🙂

Is my understanding about these 3 log messages correct?
If so, is there any way to get a "External IOC - Fetch succeeded" type message that includes the actual feed that was updated verse getting the general one I got here?
1. When I look at the partial success one, I can see the details of all 3 feeds, the 2 that updated and the other one with the error.
2. For our testing, I would like to get a more clear log of the success of the single feed we updated that our SIEM can filter on as a means to know our updates were processed.
  1. I noticed that "External IOC - Fetch succeeded" messages can get noisy depending on the # of feeds you use; especially on a 3rd party one that might update a lot.
  2. Therefore, our key is to have our feed file update => allow our GWs to fetch every 5min => log back when the update was successfully updated for the given feed => avoid the manual labor of logging into various GWs to validate the feed in question updated 😉

Thanks in advance 🙂

**note**

GW & MGMT running R81.10 Take 95

Re: External IOC - Log questions

PhoneBoy — Sat, 01 Jul 2023 15:40:45 GMT

As far as I know, you have a clear understanding of this.
Unfortunately, I don't believe you can change the detail of the logging about what feeds were updated.
It's possible this is improved in R81.20 where we can support a larger number of indicators and Network Feeds are an option.

topic External IOC - Log questions in General Topics

External IOC - Log questions

Re: External IOC - Log questions