FortiSIEM Configuration Guide for Malware Patrol Threat Intel Feeds

Malware Patrol offers the following threat intelligence feeds formatted for integration into FortiSIEM. This allows users to combine the quality of Fortinet’s SIEM security platform with the protection from our threat intelligence. Customers can choose the feed(s) that meet their needs:

• DNS-over-HTTPS (DoH) Servers (domains)
• Malicious Domains
• Malicious Hashes
• Malicious IPs
• Malware/Ransomware URLs

We offer free evaluations of our Enterprise feeds, including those for FortiSIEM. To request your evaluation, complete our request form.

About FortiSIEM

“FortiSIEM brings together visibility, correlation, automated response, and remediation in a single, scalable solution. It reduces the complexity of managing network and security operations to effectively free resources, improve breach detection, and even prevent breaches. What’s more is that [the] architecture enables unified data collection and analytics from diverse information sources including logs, performance metrics, security alerts, and configuration changes. FortiSIEM combines the analytics traditionally monitored in separate silos of the security operations center (SOC) and network operations center (NOC) for a more holistic view of the security and availability of the business.” “FortiGuard Threat Intelligence and Indicators of Compromise (IOC) and Threat Intelligence (TI) feeds from commercial, open source, and custom data sources integrate easily into the security TI framework. This grand unification of diverse sources of data enables organizations to rapidly identify root causes of threats, and take the steps necessary to remediate and prevent them in the future. Steps can often be automated with new Threat Mitigation Libraries for many Fortinet products. External Threat Intelligence Integrations

• APIs for integrating external threat feed intelligence – Malware domains, IPs, URLs, hashes, Tor nodes
• Built-in integration for popular threat intelligence sources – ThreatStream, CyberArk, SANS, Zeus, ThreatConnect
• Technology for handling large threat feeds – incremental download and sharing within cluster, real-time pattern
  matching with network traffic. All STIX and TAXII feeds are supported”

Adding External TI – A FortiSIEM Configuration Guide

The following are instructions to configure each of our data feeds on FortiSIEM version 6.4.0 (1412) using the web interface.

DNS-over-HTTPS (DoH) Domains

Benefits of the Malware Patrol DoH Data Feed

We developed this feed to help security teams monitor the use of DoH in their environment. Our tools actively search for new DoH servers on a continuous basis to keep this data fresh. DoH allows users to bypass the DNS-level controls and internet usage policies put in place to protect your network against known threats and threat actors are taking advantage of this by using DoH for C2 server connections, for example. As such, both incoming and outgoing DoH traffic should be closely monitored for indications of malicious activity.

1) From the FortiSIEM dashboard, navigate to Resources in the top navigation menu. On the left side menu that appears, you will see the types of IoC feeds that can be integrated.

2) Select Malware Domains from the menu on the left.

3) Click + button at the upper left-hand side of this side menu to add a new Malware Domains group.

4) Enter a group name. We will use Malware Patrol – DoH to distinguish this feed from the Malware Patrol Malicious Domains previously entered.

5) Click save. The Malware Patrol – DoH group will now appear under the Malware Domains section.

6) Select/highlight the Malware Patrol group and then More from the top menu.

7) Select Update from the drop-down menu.

8) On the screen that pops up choose Update via API and click on the edit (pencil) button.

9) Enter the following to set up the feed update:

• URL of your Malware Patrol DoH feed or evaluation feed. This can be obtained by right clicking on the feed’s link in the Malware Patrol customer or evaluation portal.
• Your Malware Patrol portal username and password
• Plugin Class: no changes
• Field separator: ,
• Data format: CSV
• Data update: Full

10) In the Data Mapping section, match the following:

• Domain Name, Position 1
• Description, Position 2
• Last Seen, Position 3

11) Click Save

12) Click on the Schedule: + button

13) On the screen that pops up, enter:

• Start Time: Set a start time a few minutes from the current time. This will cause the data to be updated after your setup is complete
• Recurrence Pattern: Hourly, Every 1 Hour (Malware Patrol feeds are updated on an hourly basis)
• Recurrence:
  • Start From: Today’s Date
  • End Date: No End Date
• Click Save

14) The data will populate at the start time set above. If it does not, click the Refresh button at the top of the data display area. Another option is to go back to the schedule settings to verify the time you set for the updates to begin. You can set another time a few minutes in the future.

15) To change the columns displayed once the data populates, click on the Select Columns button located beside the refresh button. Use the data mapping information from the setup process to know which fields are available in the Malware Patrol feed.

Malicious Domains

Benefits of the Malware Patrol Malicious Domains Data Feed

This Malware Patrol feed contains domains actively involved in malicious activities. The data is derived from five of our Enterprise feeds: 1) Anti-Mining, 2) Command & Control (C2) Addresses, 3) Domain Names Generated via DGAs, 4) Malware & Ransomware URLs, and 5) Phishing URLs. Network traffic associated with these domains is highly likely to be malicious.

1) From the FortiSIEM dashboard, navigate to Resources in the top navigation menu. On the left side menu that appears, you will see the types of IoC feeds that can be integrated.

2) Select Malware Domains from the menu on the left.

3) Click + button at the upper left-hand side of this side menu to add a new Malware Domains group.

4) Enter a group name. We will use Malware Patrol for this guide.

5) Click save. The Malware Patrol group will now appear under the Malware Domains section.

6) Select/highlight the Malware Patrol group and then More from the top menu.

7) Select Update from the drop-down menu.

8) On the screen that pops up choose Update via API.

9) Click on the edit (pencil) button for the URL.

10) Enter the following to set up the feed update:

• URL of your Malware Patrol Malicious Domains feed or evaluation feed. This can be obtained by right clicking on the feed’s link in the Malware Patrol customer or evaluation portal.
• Your Malware Patrol portal username and password
• Plugin Class: no changes
• Field separator: ,
• Data format: CSV
• Data update: Full

11) In the Data Mapping section, match the following:

• Domain Name, Position 1
• Malware Type, Position 2
• Description, Position 3
• Date Found, Position 4
• Last Seen, Position 5

12) Click Save

13) Click on the Schedule: + button

14) On the screen that pops up, enter:

• Start Time: Set a start time a few minutes from the current time. This will cause the data to be updated after your setup is complete
• Recurrence Pattern: Hourly, Every 1 Hour (Malware Patrol feeds are updated on an hourly basis)
• Recurrence:
  • Start From: Today’s Date
  • End Date: No End Date
• Click Save

15) The data will populate at the start time set above. If it does not, click the Refresh button at the top of the data display area. Another option is to go back to the schedule settings to verify the time you set for the updates to begin. You can set another time a few minutes in the future.

16) To change the columns displayed once the data populates, click on the Select Columns button located beside the refresh button. Use the data mapping information from the setup process for each feed to know which fields are available in the Malware Patrol feed. 

Malicious IPs

Benefits of the Malware Patrol Malicious IPs Data Feed

This feed contains IP addresses known to actively host malicious files and C2 systems for malware and ransomware. Monitoring traffic destined to them is an effective network protection measure and provides valuable information for threat hunting purposes.

1) From the FortiSIEM dashboard, navigate to Resources in the top navigation menu. On the left side menu that appears, you will see the types of IoC feeds that can be integrated.

2) Select Malware IPs from the menu on the left.

3) Click + button at the upper left-hand side of this side menu to add a new Malware IPs group.

4) Enter a group name. We will use Malware Patrol for this guide.

5) Click save. The Malware Patrol group will now appear under the Malware IPs section.

6) Select/highlight the Malware Patrol group and then More from the top menu.

7) Select Update from the drop-down menu.

8) On the next screen, choose Update via API and click on the edit (pencil) button.

9) Enter the following to set up the feed update:

• URL of your Malware Patrol Malicious IPs feed or evaluation feed. This can be obtained by right clicking on the feed’s link in the Malware Patrol customer or evaluation portal.
• Your Malware Patrol portal username and password
• Plugin Class: no changes
• Field separator: ,
• Data format: CSV
• Data update: Full

•  

10) In the Data Mapping section, match the following:

• Name, Position 1
• Low IP, Position 2
• Malware Type, Position 3
• Description, Position 4
• Date Found, Position 5
• Last Seen, Position 6

11) Click Save

12) Click on the Schedule: + button

13) On the next screen, enter:

• Start Time: Set a start time a few minutes from the current time. This will cause the data to be updated after your setup is complete
• Recurrence Pattern: Hourly, Every 1 Hour (Malware Patrol feeds are updated on an hourly basis)
• Recurrence:
  • Start From: Today’s Date
  • End Date: No End Date
• Click Save

14) The data will populate at the start time set above. If it does not, click the Refresh button at the top of the data display area. Another option is to go back to the schedule settings to verify the time you set for the updates to begin. You can set another time a few minutes in the future.

15) To change the columns displayed once the data populates, click on the Select Columns button located beside the refresh button. Use the data mapping information from the setup process for each feed to know which fields are available in the Malware Patrol feed.

Malware Hashes

Benefits of the Malware Patrol Malware Hashes Data Feed

This feed contains the SHA-1 hashes of malware and ransomware samples currently available on the internet. Encountering these signatures in your environment is a sign of malicious activity.

1) From the FortiSIEM dashboard, navigate to Resources in the top navigation menu. On the left side menu that appears, you will see the types of IoC feeds that can be integrated.

2) Select Malware Hash from the menu on the left.

3) Click + button at the upper left-hand side of this side menu to add a new Malware Hash group.

4) Enter a group name. We will use Malware Patrol for this guide.

5) Click save. The Malware Patrol group will now appear under the Malware Hash section.

6) Select/highlight the Malware Patrol group and then More from the top menu.

7) Select Update from the drop-down menu.

8) On the next screen, choose Update via API and click on the edit (pencil) button.

9) Enter the following to set up the feed update:

• URL of your Malware Patrol Malware Hashes feed or evaluation feed. This can be obtained by right clicking on the feed’s link in the Malware Patrol customer or evaluation portal.
• Your Malware Patrol portal username and password
• Plugin Class: no changes
• Field separator: ,
• Data format: CSV
• Data update: Full

10) In the Data Mapping section, match the following:

• Description, Position 1
• Algorithm, Position 2
• HashCode, Position 3
• Malware Type, Position 4
• Date Found, Position 5
• Last Seen, Position 6

11) Click Save

12) Click on the Schedule: + button

13) On the next screen, enter:

• Start Time: Set a start time a few minutes from the current time. This will cause the data to be updated after your setup is complete
• Recurrence Pattern: Hourly, Every 1 Hour (Malware Patrol feeds are updated on an hourly basis)
• Recurrence:
  • Start From: Today’s Date
  • End Date: No End Date
• Click Save

14) The data will populate at the start time set above. If it does not, click the Refresh button at the top of the data display area. Another option is to go back to the schedule settings to verify the time you set for the updates to begin. You can set another time a few minutes in the future.

15) To change the columns displayed once the data populates, click on the Select Columns button located beside the refresh button. Use the data mapping information from the setup process for each feed to know which fields are available in the Malware Patrol feed.

Malware URLs

Benefits of the Malware/Ransomware URLs Data Feed

This feed contains URLs known to be hosting malware binaries. It is updated hourly to remove inactive URLs and add newly detected ones. Correlating this feed with network traffic can pinpoint a potential malware infection.

1) From the FortiSIEM dashboard, navigate to Resources in the top navigation menu. On the left side menu that appears, you will see the types of IoC feeds that can be integrated.

2) Select Malware URLs from the menu on the left.

3) Click + button at the upper left-hand side of this menu to add a new Malware URLs group.

4) Enter a group name. We will use Malware Patrol for this guide.

5) Click save. The Malware Patrol group will now appear under the Malware URLs section.

6) Select/highlight the Malware Patrol group and then More from the top menu.

7) Select Update from the drop-down menu.

8) On the next screen, choose Update via API and click on the edit (pencil) button.

9) Enter the following to set up the feed update:

• URL of your Malware Patrol Malware URLs feed or evaluation feed. This can be obtained by right clicking on the feed’s link in the Malware Patrol customer or evaluation portal.
• Your Malware Patrol portal username and password
• Plugin Class: no changes
• Field separator: ,
• Data format: CSV
• Data update: Full

10) In the Data Mapping section, match the following:

• URL, Position 1
• Malware Type, Position 2
• Last Seen, Position 3

11) Click Save

12) Click on the Schedule: + button

13) On the next screen, enter:

• Start Time: Set a start time a few minutes from the current time. This will cause the data to be updated after your setup is complete
• Recurrence Pattern: Hourly, Every 1 Hour (Malware Patrol feeds are updated on an hourly basis)
• Recurrence:
  • Start From: Today’s Date
  • End Date: No End Date
• Click Save

14) The data will populate at the start time set above. If it does not, click the Refresh button at the top of the data display area. Another option is to go back to the schedule settings to verify the time you set for the updates to begin. You can set another time a few minutes in the future.

15) To change the columns displayed once the data populates, click on the Select Columns button located beside the refresh button. Use the data mapping information from the setup process for each feed to know which fields are available in the Malware Patrol feed.

If you need any assistance with this FortiSIEM configuration guide, please email support (@) malwarepatrol.net or contact your Account Manager.

MISP Configuration Guide

MISP is a threat intelligence platform for gathering, sharing, storing, and correlating indicators of compromise of targeted attacks, threat intelligence, financial fraud information, and vulnerability information.

It can be configured to ingest MISP-formatted data feeds. To ingest the data provided by Malware Patrol following these steps:

If you encounter any difficulties with this MISP configuration guide, feel free to contact our tech support at support (@) malwarepatrol.net

Configuration guides for other systems can be found on our Tech Support page.

FortiGate Configuration Guide for Malware Patrol Threat Intel Feeds

FortiGate NGFW delivers industry-leading enterprise security for any edge at any scale with full visibility and threat protection. Organizations can weave security deep into the hybrid IT architecture and build security-driven networks to achieve:

• Ultra-fast security, end to end
• Consistent real-time defense with FortiGuard Services
• Excellent user experience with security processing units
• Operational efficiency and automated workflows

Malware Patrol offers (5) feeds formatted for integration into the FortiGate Security Fabric (External Connectors/Threat Feeds). Customers can choose the feed(s) that meet their needs:

• DNS-over-HTTPS (DoH) Servers (domains)
• Malicious Domains
• Malicious Hashes
• Malicious IPs
• Malware/Ransomware URLs

We have written this FortiGate configuration guide for both connecting and enabling protection with Malware Patrol feeds. Please note that some of the functionalities covered in this guide require a subscription, such as FortiGuard AntiVirus for using Malicious Hashes.

Also, following the instructions in the FortiGate Administration Guide, we have mostly modified default settings and policies whenever adding Malware Patrol’s feeds. For logging or other purposes you may wish to create new ones instead. Additional resources are included at the end of this guide, including a link to FortiGate’s manual.

Adding External Threat Data Feeds – A FortiGate Configuration Guide

1) From inside the FortiGate interface, select Security Fabric > External Connectors. For this configuration guide, we have already added the Malware Patrol Malicious Hashes feed as an example, seen below.

2) Click Create New

3) Scroll down to Threat Feeds section

4) Select feed type to be added. Options are:

a. FortiGuard Category (for URL lists)
b. IP Address
c. Domain Name (for this example)
d. Malware Hash

5) Complete the following in the fields on the next page:

• Feed name: We will use Malware Patrol Malicious Domains
• URL: You can find the URL of the Malware Patrol Malicious Domains data feed in the evaluation or customer portal
• Login credentials: Username and password for Malware Patrol evaluation or customer portal
• Refresh rate: We use 61 minutes as our feeds are updated hourly

6) Click OK to save. You will now see the new feed added to the list of connectors.

7) Click Create New to add any additional feed(s) you have. Instructions for each are the same as the previous example. For the examples in this how-to, we use the names below:

a. FortiGuard Category (for URL lists) – Malware Patrol Malicious URLs
b. IP Address – Malware Patrol Malicious IPs
c. Domain Name – Malware Patrol Malicious Domains
d. Malware Hash – Malware Patrol Malicious Hashes

8) Click the refresh button and hover over any feed to see details, including number of valid/invalid entries

9) Click View Entries to see the feed’s entries

Adding IP data feeds to firewall policies

1) Navigate to Policy & Objects > Firewall Policy

2) Click Create New

3) Complete the following in the fields on the next page:

• Name: We will use Malware Patrol IP Deny List
• Select incoming and outgoing interfaces: per your needs/environment
• Source: All
• Destination: Malware Patrol Malicious IPs list (menu appears on right, scroll down)
• Schedule: Always
• ServiceAll
• Action: Deny

4) Click OK to save. New policy will appear in list

FortiGate policy details: https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/118003/policies

FortiGate video: https://youtu.be/dpvlQ0xU2NU

Adding an external malware blocklist (hashes) to the AntiVirus

1) Navigate to Security Profiles > AntiVirus

2) Click to edit the default profile

3) Enable Use external malware block list (toward bottom of page). Also enable Quarantine if desired.

4) Select ‘Specify’ in the Virus Outbreak Prevention

5) Click the + and select the Malware Patrol Malicious Hashes feed from the menu

6) Click OK to save

FortiGate AntiVirus details: https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/913906/external-blocklist-file-hashes

Adding a URL blocklist to the web filter

1) Navigate to Security Profiles > Web Filter

2) Click to edit the default profile

3) Select Malware Patrol Malicious URLs from FortiGuard Category Based Filter menu

4) Right click on Disable and select Block from dropdown menu

5) Click OK to save

FortiGate Web Filter details: https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/833698/web-filter

Adding a domain blocklist to the DNS filter

1) Navigate to Security Profiles > DNS Filter

2) Double click to edit the default profile

3) Select Malware Patrol Malicious Domains from FortiGuard Category Based Filter menu (scroll down to Remote Categories section)

4) Right click on Allow and select Redirect to Block Portal from dropdown menu

5) Click OK to save

FortiGate DNS Filter details: https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/605868/dns-filter

Additional resources

FortiGate Administration Guide: https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/954635/getting-started

FortiGate Administration Guide, threat data feeds: https://docs.fortinet.com/document/fortigate/7.0.2/administration-guide/9463/threat-feeds

Excellent walk-through video for adding and enabling external threat feeds: Configure and use 3rd Party threat feeds on a FortiGate Firewall by GraniteDan https://youtu.be/CarI6_URN90

If you need any assistance with this FortiGate configuration guide, please email support (@) malwarepatrol.net or contact your Account Manager.

Malware Patrol offers MikroTik-compatible versions of our Malicious Domains, DNS-over-HTTPS (DoH) Servers, and Tor Exit Nodes data feeds. This guide walks you through each step to configure your MikroTik router accordingly. If you need assistance at any point, our support team is here to help.

“MikroTik is a Latvian company founded in 1996 to develop routers and wireless ISP systems. MikroTik now provides hardware and software for Internet connectivity in most countries around the world. Our experience in using industry-standard PC hardware and complete routing systems allowed us in 1997 to create the RouterOS software system that provides extensive stability, controls, and flexibility for all kinds of data interfaces and routing.”

You can follow these simple steps to configure your MikroTik to filter malicious domains to protect your network, computers, and users from getting infected by malware and ransomware. This includes domains derived from C2s, DGAs, and URLs hosting malware and ransomware binaries.

1) You will need the username and password provided to you by Malware Patrol. If you are evaluating, this will be your evaluation portal credentials. If you are a customer, you will use your account login details and portal URL.

2) Execute the following commands in MikroTik’s CLI:

Malicious Domains

/system script  add name=”MP_UpdateMaliciousDomains” owner=”admin” policy=ftp,read,write dont-require-permissions=no source={
/tool fetch url=”https://_username_:_password@eval.malwarepatrol.net/feeds/files/MP_malicious_domains.mikrotik.rsc” mode=https

/ip firewall address-list remove [find where comment=”MP_Malicious_domain”]
/import file-name=MP_malicious_domains.mikrotik.rsc ;
}

/ip firewall filter add chain=forward action=drop protocol=tcp dst-address-list=MP_MaliciousDomains log=yes log-prefix=”Blocked_by_MP_MaliciousDomains”

/system scheduler add name=MP_UpdateMaliciousIPsFeed interval=1h on-event=MP_UpdateMaliciousIPs owner=admin policy=ftp,read,write

The code above will create a script that downloads and updates the Malicious Domains list. The system scheduler portion will schedule the download and update processes to happen on an hourly basis. We advise this frequency because our lists are updated every hour.

If you encounter any difficulties during the Mikrotik router configuration process, feel free to contact our tech support at support (@) malwarepatrol.net

Configuration guides for other systems can be found on our Tech Support page.

Malware Patrol provides block lists compatible with SpamAssassin.
 

“Apache SpamAssassin is the #1 Open Source anti-spam platform giving system administrators a filter to classify email and block spam (unsolicited bulk email).

It uses a robust scoring framework and plug-ins to integrate a wide range of advanced heuristic and statistical analysis tests on email headers and body text including text analysis, Bayesian filtering, DNS blocklists, and collaborative filtering databases.

Apache SpamAssassin is a project of the Apache Software Foundation (ASF).”
 

You can follow these simple steps to configure your SpamAssassin to filter malicious URLs and protect your network, computers, and users from getting infected by malware.

1) Make sure your SpamAssassin instance is installed and working properly. There are several resources on the Internet that can help you configure it in your platform. If you are experiencing trouble installing and configuring SpamAssassin, start at: https://spamassassin.apache.org/

2) On the server running SpamAssassin, create a file called malware_patrol_update.sh choosing where to place it, like:
# mkdir /root/sh
# vi /root/sh/malware_patrol_update.sh

3) Log into your account with Malware Patrol and look for SpamAssassin. Right click on “download” and select “Copy link location”. You will need this URL on the next step.

4) Paste the following command into the newly created file, substituting _URL_YOU_JUST_COPIED_ with the URL you copied in the previous step:

wget --no-check-certificate -O /etc/mail/spamassassin/99_malware_patrol_blocklist.cf '_URL_YOU_JUST_COPIED_'

Feel free to customize the output filename. SpamAssassin configuration files are read in an alphanumerical order, meaning 70_*.cf will be read before 99_*.cf.

5) It is very important to make sure that the URL you have copied from your account with Malware Patrol is enclosed in single quotes.

6) Add the following line to the file and save it:

systemctl restart spamassassin.service

If Amavisd is used (so SpamAssassin is managed by it) use the following line instead and save it:

systemctl restart amavisd.service

7) Add execute permissions to the recently created file, executing this command:

# chmod +755 /root/sh/malware_patrol_update.sh

8) Execute the recently created file that will download the latest block list and restart SpamAssassin or Amavisd:

# /bin/sh /root/sh/malware_patrol_update.sh

9) Make sure the new file was correctly processed by SpamAssassin by running the following command:

# spamassassin -D --lint 2>&1 | grep "malware_patrol"
... dbg: config: read file /etc/mail/spamassassin/99_malware_patrol_blocklist.cf

10) You should now create a cron job to automatically update the Malware Patrol block list. The following command should be executed every hour:

/bin/sh /root/sh/malware_patrol_update.sh

Please choose minutes not close to 00, 01 and 59 for your cron job.

If you experience any difficulties configuring SpamAssassin to use Malware Patrol block lists, please make sure it is working properly and contact our tech support at support (@) malwarepatrol.net.
 

Special thanks to Malware Patrol user fRANz for writing this guide.

Share this post: Tweet

“With Cisco ASA with FirePOWER Services, you consolidate multiple security layers in a single platform, eliminating the cost of buying and managing multiple solutions. This integrated approach combines best-in-class security technology with multilayer protection integrated in a single device that is less costly than piecemeal security solutions.”

For more information, see Cisco’s product description: http://www.cisco.com/c/dam/en/us/products/collateral/security/asa-firepower-services/at-a-glance-c45-732426.pdf

Malware Patrol provides threat data compatible with Cisco ASA FirePOWER security intelligence feeds. There are three types of feeds that can be applied:

1. IP addresses: includes IP addresses of malware C&Cs as well as those resolved from malware and ransomware DGAs.
2. URLs: includes partial URLs used by malware and ransomware to contact command and control systems and drop zones.
3. Domains: includes registered active domains generated via DGAs for malware and ransomware.

You can follow these simple steps to configure your Cisco ASA FirePOWER to filter malicious IPs and protect the internal network, computers and users from getting infected by malware. The same procedure can be followed to filter URLs and domains.

1) Log in to Cisco FirePOWER Management Center.

2) Choose Objects > Object Management.

3) Expand the Security Intelligence node, then choose Network Lists and Feeds.

4) Click Add Network Lists and Feeds.
5) Enter a name for the feed (ex: MalwarePatrol_malicious_IPs).
6) Choose Feed from the Type drop-down list.
7) Enter the corresponding feed URL that can be found logging in to the Malware Patrol website.
8) Enter the corresponding feed MD5 URL that can be found logging in to the Malware Patrol website.
9) Choose the Update Frequency, we suggest one hour.
10) Choose Save.

11) Click Update Feeds.

12) Cisco ASA FirePOWER will automatically update the data feed at the chosen interval.

13) Choose Policies / Access Control and click New Policy.

14) Enter a meaningful Name and Description to the policy. The Default Action must be Block all traffic. On Available Devices select the devices that will be affected by the policy and click Add to Policy. When you are done, click Save.

15) A new policy will be created. Click on Security Intelligence.

16) On Available Objects / Networks select the object created previously (ex: MalwarePatrol_malicious_IPs), choose a zone from Available zones (Any is the default) and click on Add to Blacklist.

17) The object and corresponding policy were created successfully. You can follow the same steps to use the other data feeds we provide.

If you experience any difficulties configuring Cisco ASA FirePOWER to use Malware Patrol data feeds, please make sure it is working properly and contact our tech support at support (@) malwarepatrol.net.