Creating Custom Feeds, Dynamic, Black and White

• Know what type of feed you are configuring and have all the necessary information on hand. For example, for custom feeds from a file server, you must have the file server URL and a valid user name and password for the file server. Local feeds are created on your local system and uploaded from there.
• To use a custom feed, apply it to the source or destination address in a firewall rule. In the firewall rule, you can filter addresses to show Dynamic Addresses.
• For creating an Infected Host custom feed, see Creating Custom Feeds, Infected Host.

1. Select Configure>Threat Prevention>Custom Feeds.
2. Select one of the following feed types.

   Table 1: Custom Feed Categories

   Feed Category	Definition
   Dynamic Address	A dynamic address entry provides dynamic IP address information to security policies. A dynamic address is a group of IP addresses, not just a single IP prefix, that can be imported from external sources. These IP addresses are for specific domains or for entities that have a common attribute such as a particular undesired location that poses a threat. You can then configure security policies to use the dynamic addresses within a security policy. Note: For Dynamic Address, you can create multiple custom feeds. For Whitelist, Blacklist, and Infected Host, you can only create one custom feed for each.
   Whitelist	A whitelist contains known trusted IP addresses, URLs, and domains. Content downloaded from locations on the whitelist does not have to be inspected for malware.
   Blacklist	A blacklist contains known untrusted IP addresses, URLs, and domains. Access to locations on the blacklist is blocked, and therefore no content can be downloaded from those sites.
   Infected Host	Infected hosts are hosts known to be compromised. Enter host IP addresses manually or upload a text file with the IP addresses of infected hosts. See Creating Custom Feeds, Infected Host for configuration details.

3. Click Create and select one of the following:
   • Feeds with local files—This is data you enter manually into the provided fields or upload from a text file on your location machine. See Table 2 for details.
   • Feeds with remote file server—This is a data feed from a remote server. Configure communication with the remote server using instructions in Table 3.
4. Complete the configuration by using the guidelines inTable 2 or Table 3.
5. Click OK. Your entry is added to custom list displayed at the bottom of the page.

Note: To use a custom feed, apply it to the source or destination address in a firewall rule. In the firewall rule, you can filter addresses to show Dynamic Addresses.

Use the fields in Table 2 to add custom feeds.