Hello,
I've been testing out some external IOCs for a production rollout and was hoping to get some understandings on some of the log messages. I have 3 feeds running for testing: one IP host list, one url list and one domain list.
When looking at "blade:Anti-Virus AND type:Control" in smartconsole, I get these logs under the 'forensics Details => Description" and what my understanding is:
- External IOC - Fetch succeeded
- I know that the configs are setup to fetch the feed every 5min but the log seems to show up only when there was an actual update to the feed txt/csv file on the remote server.
- So....my understanding is when i see this message it means at least 1 of the 3 feeds had an update and such fetch is good.
- External IOC - Partial success, IP_TEST: Success, URL_TEST: Success, DOMAIN_TEST: Feed format problem. Empty feed"
- I read this the same as the above message except that one of the feeds had a problem due to the feed having no domains listed (which was the test case). The other two feeds 'fetched'
- External IOC - External Indicators processing failed
- This one seems straightforward to me as it detailed out that the processing failed and the reason.
- Our reason was "Couldn't connect to server"; which is accurate during our testing and the remote server was down.
- I also noticed that I got this message every 5 min; which solidifies that the GW was attempting updates within the defined interval.
So.....now my questions 🙂
- Is my understanding about these 3 log messages correct?
- If so, is there any way to get a "External IOC - Fetch succeeded" type message that includes the actual feed that was updated verse getting the general one I got here?
- When I look at the partial success one, I can see the details of all 3 feeds, the 2 that updated and the other one with the error.
- For our testing, I would like to get a more clear log of the success of the single feed we updated that our SIEM can filter on as a means to know our updates were processed.
- I noticed that "External IOC - Fetch succeeded" messages can get noisy depending on the # of feeds you use; especially on a 3rd party one that might update a lot.
- Therefore, our key is to have our feed file update => allow our GWs to fetch every 5min => log back when the update was successfully updated for the given feed => avoid the manual labor of logging into various GWs to validate the feed in question updated 😉
Thanks in advance 🙂
**note**
GW & MGMT running R81.10 Take 95
