topic Re: Custom Intelligence Feeds Vs Network feeds in General Topics

Custom Intelligence Feeds Vs Network feeds

Ven — Fri, 24 May 2024 07:01:26 GMT

Hello Mates,

I`ve a customer who is blocking thousands of Block listed ip`s by manually creating objects on the sms. I see that in R81.20 we have Custom Intelligence feeds and Network Feeds.

Which out of these 2 methods is scalable and more quick to enable and enforce on gateways ?

Also what is the primary difference btw these 2 features in terms of understanding, implementing.

Re: Custom Intelligence Feeds Vs Network feeds

the_rock — Fri, 24 May 2024 07:24:31 GMT

They both work well, but network feeds dont require av or ab blade enabled.

Im in Faroe Islands now, so no access to my laptop as Im on vacation, but have a look at post I made, hope it helps. Personally, I would say both are scalable.

Best,

Andy

https://community.checkpoint.com/t5/Security-Gateways/Network-feed/m-p/212407

Also, they get auto updated, which is fantastic.

Hope that helps.

Re: Custom Intelligence Feeds Vs Network feeds

the_rock — Fri, 24 May 2024 10:09:00 GMT

@Ven I would say try it, I gave network feeds idea to one customer, smaller hospital, all those 9 feeds in the post, in 2 days, they had 3 mil hits, pretty good, I would say.

Best,

Andy

Re: Custom Intelligence Feeds Vs Network feeds

Bob_Zimmerman — Fri, 24 May 2024 13:33:17 GMT

Network feeds are normal objects which you can use in rules. They can be used to allow stuff.

Custom intelligence feeds can only be used to drop stuff.

Re: Custom Intelligence Feeds Vs Network feeds

PhoneBoy — Fri, 24 May 2024 17:15:39 GMT

Actually, in R81.20, they're both fairly scalable since the infrastructure was updated.

Custom Intelligence Feeds can only be used with Threat Prevention blades and, as @Bob_Zimmerman said, they are used to block stuff.
Custom Intelligence Feeds have existed since R77.30.

Network Feeds can be used in the Access Policy and can be used both in the Access/NAT Policy and the Threat Prevention policy.
They can be used for both allowing and blocking stuff.