centrally defined IOC-feed active in all policies

[Wolfgang]

We have a management with some different policies for different gateways. If we define IOC-Feeds in one of the ThreatPrevention policy we can see this IOC-feed in all other policies. And after policy install this IOC-feed is active on all gateways. I believe the IOC-feed should be active only for the policy configured for and not for all policy-packages.

Can someone please confirm the behavior.

[Alex-]

As far as we're aware, the "Custom Policy Tools" section is global for all policies in the same management domain.

[CaseyB]

I have noticed the same thing; I was also curious on how to only apply IOC feeds to certain gateways.

[the_rock]

Thats an excellent question @Wolfgang . Please let us know if you find out how to do this.

Andy

[Wolfgang · Accepted solution]

I've got an answer from TAC. All settings under "Custom Policy Tools" are global for the whole management, they are not independent for different policies.