topic Re: IOC Feeds on Quantum Spark R81 in Spark Firewall (SMB)

IOC Feeds on Quantum Spark R81

LUCAM — Tue, 22 Oct 2024 13:58:34 GMT

Hi,

in my Quantum Spark 1500 series I'm trying to add some IOC custom feeds, in particular I'm trying to add this:

I looked at this articles

but adding the feed in CLI expert mode I always receive "Illegal characters in command"

CHECKPOINT> ioc_feeds add --feed_name remote_feed --transport https --resource "https://secureupdates.checkpoint.com/IP-list/TOR.txt"
Illegal characters in command

I also tried adding CSV feeds found in sk132193 but I always get the same error

Can you help me where am I going wrong?

thank you

Chris_Atkinson — Tue, 22 Oct 2024 14:16:29 GMT

I have a customer with similar working, what firmware version/build are you using?

R81.10.10 Build 996002906 (or higher)

SMBGWY-8631 Firewall New Feature: In the ioc_feeds command on a Centrally Managed Gateway, added support for IoC Feed from a custom CSV format.

Supported IoC types: IP Address, Domain Name, MD5 Hash, SHA1 Hash, SHA256 Hash.

LUCAM — Tue, 22 Oct 2024 14:09:54 GMT

Model
1530 Appliance

Version
R81.10.10 (996002993)

LUCAM — Tue, 22 Oct 2024 15:14:04 GMT

I confirm it works fine thank you Chris

LUCAM — Fri, 25 Oct 2024 09:08:09 GMT

I have a new question about this topic 😀😀

Now I have the IOC feeds configured as shown in attached file.

Even if the tor list is active and in prevent, I did some tests and I am able to reach some services behind the SMB through the Tor network.

Did I miss some configurations?

thank you

PhoneBoy — Fri, 25 Oct 2024 19:58:46 GMT

Did you confirm the source IP of the communication is covered in those lists?
Suggest also engaging TAC.

LUCAM — Sat, 26 Oct 2024 13:36:57 GMT

Yes, the IPv4 is covered in the list,

I will contact TAC

thank you