Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Danny
Champion
Champion

Are IoC feeds processed before Access Control policy?

Our access control policy blocks specific countries in the source column of rule #1 (Geo block).
We also have IoC Feeds for that countries' IP addresses in place.

Our firewall log shows:

image.png

Rule #1 (Geo Block) isn't listed within 'Matched Rules', just IPS and Threat Prevention:

image.png

Usually Access Control gets processed before Threat Prevention while it absolutely makes sense to block blacklisted IP addresses before Access Control. Since IoC Feeds are configured and installed with the Threat Prevention policy I'm trying to understand how IoC feeds work before Access Control.

6 Replies
This widget could not be displayed.