Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Replies 3 replies
  • Subscribers 40 subscribers
  • Views 220 views
  • Users 0 members are here
Options
Suggested

SFOS 21 Third-party threat feed limits

mierwins

What's the limiting factor on the third party threat feeds?  I current have 617,819 total IOC's in a v21 system running on a VM (software) and when trying to load another list here: https://raw.githubusercontent.com/hagezi/dns-blocklists/main/domains/tif.txt  it tells me the storage is full.   

Is there any way to increase this?  



added TAGs
[edited by: Raphael Alganes at 8:34 AM (GMT -8) on 23 Dec 2024]
Parents
  • 0

    SFOS uses the RAM to slice enough storage for the Third Party feed. 

    Does your system not have enough memory? By using only 4 GB RAM; we will not have enough memory to allocate enough space for many IoCs here. (Keep in mind, Sophos Labs / xops is also in the same space and need storage). 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I received the same message today. (while trying to integrate the same feed)
    I then increased the memory from 4.3 GB to 6 GB. This did not bring any change. Still the same message.
    Current memory usage 50% of 6GB


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    The appliance will slice a portion (hard coded) from your total RAM for 3th Party feeds. 
    (i am not sure, if it will "redo" this task if you add more hardware - As this is an unusual task - Could be not included). 

    I am wondering, about the value of this list: 1.2 Mio entries is a lot of entries for a list. 

    __________________________________________________________________________________________________________________

Reply
  • 0 in reply to dirkkotte

    The appliance will slice a portion (hard coded) from your total RAM for 3th Party feeds. 
    (i am not sure, if it will "redo" this task if you add more hardware - As this is an unusual task - Could be not included). 

    I am wondering, about the value of this list: 1.2 Mio entries is a lot of entries for a list. 

    __________________________________________________________________________________________________________________

Children
No Data
Unfiltered HTML