IOC Feeds on Quantum Spark R81

[LUCAM]

Hi,

in my Quantum Spark 1500 series I'm trying to add some IOC custom feeds, in particular I'm trying to add this:

https://secureupdates.checkpoint.com/IP-list/TOR.txt

I looked at this articles

https://support.checkpoint.com/results/sk/sk132193

https://support.checkpoint.com/results/sk/sk103154

but adding the feed in CLI expert mode I always receive "Illegal characters in command"

CHECKPOINT> ioc_feeds add --feed_name remote_feed --transport https --resource "https://secureupdates.checkpoint.com/IP-list/TOR.txt"
Illegal characters in command

I also tried adding CSV feeds found in sk132193 but I always get the same error

Can you help me where am I going wrong?

thank you

[Chris_Atkinson · Accepted solution]

I have a customer with similar working, what firmware version/build are you using?

R81.10.10 Build 996002906 (or higher)

SMBGWY-8631 Firewall New Feature: In the ioc_feeds command on a Centrally Managed Gateway, added support for IoC Feed from a custom CSV format.

Supported IoC types: IP Address, Domain Name, MD5 Hash, SHA1 Hash, SHA256 Hash.

[LUCAM]

Model
1530 Appliance

Version
R81.10.10 (996002993)

[LUCAM]

I confirm it works fine thank you Chris

[LUCAM]

I have a new question about this topic 😀😀

Now I have the IOC feeds configured as shown in attached file.

Even if the tor list is active and in prevent, I did some tests and I am able to reach some services behind the SMB through the Tor network.

Did I miss some configurations?

thank you

[PhoneBoy]

Did you confirm the source IP of the communication is covered in those lists?
Suggest also engaging TAC.

[LUCAM]

Yes, the IPv4 is covered in the list,

I will contact TAC

thank you