MX Ingestion of external threat feed

[Stealth_Network]

Hi,

Is there a way to configure the MX to ingest an IP address based threat feed. I know Firepower and other firewalls can do this but don't see any docs here that show how the MX's can do it. 

If not I will submit a feature request.

Thanks

[cmr]

No, it uses the Cisco feeds.

[Stealth_Network]

Not sure what you are meaning here?

[PhilipDAth]

Create a layer 7 firewall rule to block access to a group.

Create a group and load all of the IP addresses into that.

[Stealth_Network]

I could do that but the group only allows you to add entries one at a time. I have hundreds.

[PhilipDAth]

In steps the API.  🙂

Write a script to injest your file of things to block, and update that single object group.

[Stealth_Network]

Thank you I will investigate, have you tested this?

I spun up a webapp that housed the list and created the object, created the FW rules, but it did not work so not sure if it requires a special convention.

[CptnCrnch]

Using Cisco Defense Orchestrator (CDO), nowadays called Security Cloud Control, this would be useable via CSDAC (Dynamic Attributes Connector). Makes sense when you're dealing with more than "only" Meraki MX.

[DarrenOC]

Think I know the answer already @CptnCrnch but is that free?

[CptnCrnch]

You're right: it's not free - but something really worth to consider when managing a fleet of ASA, FTD and Meraki devices. Not even talking about the new and even more interesting things like Multicloud Defense and Hypershield.

Having harmonized objects over your whole environment and something like the mentioned above is only one of the small advantages. Having AIOps in place now, I'm really excited to present this to my customers.