Checkpoint FW management CLI IOC feeds

[Adir_Sabag]

Hi,

We are an MSSP SOC, and one of our customers has a Check Point FW. They also have a MISP server, and we want to integrate between them, and feed the FW with IOC from MISP.

What would be the best way to do it? Is there a built in feature to set a MISP IOC feed at the management FW CLI?

If not, can we export the IOCs from MISP to a csv (or other file format) and feed the FW via CLI with a custom script?

Any help appreciated,

Thank you.

[Danny]

I recommend to update your firewall to R81.20 first.
Then define your IoC Feed Urls in SmartConsole as described here.