Hello mates, I usually use the following open source project:
https://github.com/stamparm/ipsum
It sumarice malicious IP between different lists. It create lists based on the ocurrence of the IP and categorice en levels.
I have configured this IOC in my lab and it's working fine. The level 3 list has over 17K malicious IPs. From R81.20, the way of using network feeds in the access control policy, for me it is more granular.
testing network feedPolicy access rulebaseblock event Network feedUpdate Event Network feed
Best regards! 😉