I will make a brief summary about this issue and the results of the case with the TAC.
Smart Console External IOC Feeds works properly if the GWs are in R81 and above. After long sessions with the TAC, labs, Escalation Team, that was the conclusion. Maybe somebody had luck with different versions, but we could not. We had 4 different environments with SMS in R81.10 and GWS R80.40
It is clear in documentation the SMS must be in R81 and higher (Smart Console Feature), but not the GWs
From SK this part is confuse
The feature is integrated in version R80.30 and above.
Note: To import external Custom Intelligence Feeds using SmartConsole in versions R81 and higher, refer to: Threat Prevention R81 Administration Guide > Configuring Advanced Threat Prevention Settings > Configuring Threat Indicators > Importing External Custom Intelligence Feeds > Importing External Custom Intelligence Feeds in SmartConsole.
In some way they must to include the Smart console feature ¨ works properly¨ in GWs with R81 and higher. Was suggested to the TAC to edit the sk132193 and add some captures, Logs queries for verifications as is posted in CHECKMATES threads.
We tested the CLI way and works perfect in the versions they mentioned, but not the Smart console External IOC feeds.
We also realized in all the environment we tested this file could not be found when you troubleshoot
I think with all the tests we made, there is a lot of information from the case we had to edit the SK and help the community.