customer have requirements of integration and automation of external Threat Intelligence

[sureshreddy]

Dear Team,

One of our customers has requirements of integration and automation of external Threat Intelligence on Checkpoint, for example, Cisco Talos, Kaspersky, virus total, etc. or from the Threat Intelligence Server managed locally by using API. So, is this possible on Checkpoint?

Your help in this regard will be greatly appreciated.

[PhoneBoy]

This can be automated, yes.
There are a couple of options available:

• Threat Prevention APIs (e.g. add threat-indicator)
• ioc_feeds on the gateway

I believe R81 will have additional options available as well.
Note that our Threat Prevention blades pull from ThreatCloud which includes several third party sources already (though we don't disclose the exact parties).