Manage third-party threat feeds

You can see the storage quota available for threat feeds. You can also see the synchronization errors that may occur when the firewall tries to update the list of Indicators of Compromise (IoCs) from a threat feed.

You can also see the IoCs in a feed.

Summary

• Go to Active threat response > Third-party threat feeds and see the counters for the following information:

  • Active feeds: The number of active feeds and the total configured feeds.
  • Total threat indicators: The number of IPv4 addresses, domains, and URLs.

  • Storage quota: Disk space used. The allotted space depends on the firewall model. Larger appliances have more disk space than the desktop models. For more information, see Storage limit for third-party threat feeds.

    Even if storage is full, the firewall gets the IoCs at the configured polling interval. It then updates its list if disk space becomes available.

• Click Refresh to manually update the latest count.

See threat indicators

You can search for individual IoCs in a threat feed using the following options:

• Click Threat indicators under the top menu.
• Under Total indicators in the threat feed list, click the number for a feed.

Synchronization of feeds

• Under the Sync status column, see the synchronization status of the threat feed.
• Under the Manage column, click Synchronize now to manually synchronize a threat feed. Feeds are automatically synchronized at the polling interval you configure for each.
• You can turn on or off, edit, and delete a threat feed.

Synchronization statuses

See the synchronization statuses and errors.

More resources

• Add threat exclusions
• Logs and alerts for Active threat response