Meraki MX Threat Feed

[skippy]

have no experience with API's (learning them now so please be gentle) 

would like to pull down an IP block list threat feed daily (hourly would be preferred) 

https://rules.emergingthreats.net/blockrules/compromised-ips.txt

and have this added to the rule base in all of our Meraki MX Gateways ~500.

the above list is a sampling of a threat feed we've built that uses CIDR notation and contains several thousand IP addresses to block.

can someone guide me on how they've done this in the past or help me write out the API (for multiple gateways not jsut one) 

in an ideal world once this is done it will be automated and update hourly and i wont have to touch it.

[Inderdeep]

Check this one. I will also check if I can that reference with multiple gatways

https://developer.cisco.com/meraki/api-v1/#!introduction/meraki-dashboard-api

[PhilipDAth]

I think this is going the wrong way - and you would be better off using the built IPS and security content filtering ...

If you want to proceed, and because you have 500 sites, I would use network policy objects.  Policy objects are available for use in every network.  If you update a policy object, it is automatically updated for every network that references them.

You could create a network object group called something like "emerging-threats".  Create a single outbound firewall rule in every network to do a "deny all" to anything in this group.

Related APis for policy objects:

https://developer.cisco.com/meraki/api-v1/#!delete-organization-policy-objects-group 

https://developer.cisco.com/meraki/api-v1/#!delete-organization-policy-object 

[PhilipDAth]

I don't think this is the way you should do it - that you should use network policy objects - but I noticed one of my scripts can do a lot of what you want.

https://www.ifm.net.nz/cookbooks/mfw.html