topic What is the difference between Custom Intelligence feed and Network Feeds ? in General Topics

What is the difference between Custom Intelligence feed and Network Feeds ?

_khard — Fri, 13 Oct 2023 18:04:09 GMT

What is the difference between Custom Intelligence feed and Network Feeds ?

Both are used to push IP/domains which one needs to block without policy installation.

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

the_rock — Fri, 13 Oct 2023 18:17:28 GMT

https://support.checkpoint.com/results/sk/sk132193

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Network_Feed.htm?Highlight=Network%20feed

I would say biggest difference is that with network feeds, you CAN enforce fqdn, unlike with IOC you cant (not to be confused with International Olympic commitee lol)

Hope that helps.

Andy

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

PhoneBoy — Fri, 13 Oct 2023 19:26:45 GMT

Custom intelligence feeds are basically a block list for AntiVirus/AntiBot Blades, which are required to use this feature.
Network Feeds can be used in the Access Policy (in addition) and only requires Firewall blades.
Neither require a policy push to update.

Regardless of which method you use, if you have a lot of IoCs, R81.20 is a better choice as it supports millions of IoCs.

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

the_rock — Fri, 13 Oct 2023 19:33:52 GMT

Correct me if Im wrong when I say this, but dont you need a rule like below to take full advantage of IOC or is just having them in smart console enough?

Andy

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

PhoneBoy — Fri, 13 Oct 2023 20:03:51 GMT

Custom Intelligence Feeds are treated as "block" in AntiVirus/Anti-Bot blades.
There is no other configuration required in SmartConsole.

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

the_rock — Fri, 13 Oct 2023 20:10:09 GMT

K, so just to make sure Im not missing anything...are you saying IF av blade is enabled on the firewall, and also on TP profile, then generic data center objects dont need to be added to any security rule?

Andy

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

Chris_Atkinson — Sat, 14 Oct 2023 00:01:57 GMT

Generic data centre objects are used differently from IOC feeds.

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

the_rock — Sat, 14 Oct 2023 00:09:37 GMT

Thanks Chris, I was confusing some things here, long night last night troubleshooting Cisco switch lol

Anyway, I think Im good now...have a nice weekend mate.

Andy

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

_khard — Sat, 14 Oct 2023 18:32:20 GMT

Thanks @PhoneBoy for your response. I could see that the Custom Intelligence Feed supports MD5(files) as well; which aren't supported in the external network feeds.

I think basically if someone has NGFW lic - they could use it in access policy and if someone has NGTP lic - better to use Custom Intelligence Feeds.

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

the_rock — Sat, 14 Oct 2023 22:48:30 GMT

That makes sense.

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

Matlu — Wed, 02 Jul 2025 00:59:59 GMT

Hi @PhoneBoy

What is the correct way to block a list of Malicious IPs that come to us in daily newsletters like IoC?

We have a VSX environment where our VS, some of them, have Threat Prevention enabled (IPS/AV/AB)

So, if we have these Blades available is using IoC Feeds the "best option"?

Our “Feed” SOURCE can be a simple Windows server with a txt file that can be ‘updated’ whenever we need with new Malicious IPs?

Thanks for your comments.

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

the_rock — Wed, 02 Jul 2025 01:57:49 GMT

Hey bro,

FWIW, I personally recommend people use info from below (network feeds), since it does NOT need av and/or ab blades enabled.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Network-feed/m-p/212407#M40317

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

PhoneBoy — Wed, 02 Jul 2025 16:56:01 GMT

Network Feeds have a small issue in VSX: You cannot verify the feed before it saved/activated with a VS.
You have to use a non-VSX gateway for this.
At least that's the case in R81.20, not sure about R82.

IOC Feeds can be used for this purpose also if you have AV/AB blades enabled.

Re: What is the difference between Custom Intelligence feed and Network Feeds ?

the_rock — Wed, 02 Jul 2025 17:03:00 GMT

Works in R82. for sure, tested in the lab.

Andy