Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Replies 13 replies
  • Subscribers 45 subscribers
  • Views 2044 views
  • Users 0 members are here
Options
Suggested

v21 Third Party Feeds

m8ey-au

Hey all

With v21 accepting third party feeds I was hoping toi ingest the CTIS data from the ACSC but its in STIX format and the v21 only supports IoC one per line format.

I have found a couple of IP Lists to pull threat data from to add.

TorNodes for all Tor related IPs and also TALOS have a feed (both have about 1200-1500 IPS) - I can share the URL if needed but the forum blocks me if I post thgem :-0

What other feeds do you have or are looking to add?



Edited TAGs
[edited by: Erick Jan at 12:24 AM (GMT -7) on 23 Oct 2024]
  • 0 in reply to LHerzog

    I've updated my post. Sophos dug into this and found that these notifications were not due to a random probe from a now-blocked IP from a third-party list. They were from the third-party list, but they weren't the usual shotgun of probes: they were specifically to the VPN port that is open to the WAN (which is of course how you use a VPN). In that case, it is acting as expected: those probes are not (invalid) Appliance Access but are for a service that is running on the appliance and so are blocked if they're on a block list. (In the past, they would have resulted in a failed VPN login attempt if the probe actually tried to login, or would end up elsewhere if they immediately dropped the connection, I guess.)

  • 0 in reply to Steve Weißflog

    I'm a small fish so don't see a lot of what big fish see, but I haven't gotten any blocks by the URLHaus recent block list (one of their small lists). I have gotten blocks based on the FireHOL L3 list, but those were: a) VPN probes from listed IPs that I had previously not seen because they don't show up as (invalid) Appliance Access, and b) outgoing IP access that is flagged as C&C communications but the FireHOL list includes IPs that map to sites like "githubusercontent" which is an extremely broad IP.

  • 0

    Looking at the Talos URL, there is a generic URL that then redirects to the another URL, within XG v21 talosintelligence.com/documents/ip-blacklist isn't pulling a list.  I've left off the https on purpose.

    Some of the other items I'm looking at were previously on pfblockerng within pfsense.  Need to look at Crowdsec and GreyNoise more

Unfiltered HTML