Creating Custom Feeds, Infected Host
To access this page, click Configure>Threat Prevention>Custom Feeds.
- Note that infected hosts are hosts known to be compromised. For an infected host custom feed, enter host IP addresses manually or upload a text file with the IP addresses of infected hosts.
- If you create a custom infected hosts feed, it will override the SKY ATP infected hosts feed.
- To use a custom feed, apply it to the source or destination address in a firewall rule. In the firewall rule, you can filter addresses to show custom feed types, including infected hosts.
- Note that when Cloud feeds only is selected as the Threat Prevention Type, the infected host custom feed is not available.
- For creating other custom feed types, see Creating Custom Feeds, Dynamic, Black and White.
To create local file and remote file custom feeds:
- Select Configure>Threat Prevention>Custom Feeds.
- Select the Infected Host tab.
Note: When Cloud feeds only is selected as the Threat Prevention Type, the infected host custom feed is not available.
- Click Create and select one of the following:
- Feeds with local files—This is data you enter manually into the provided fields or upload from a text file on your location machine. See Table 1 for details.
- Feeds with remote file server—This is a data feed from a remote server. Configure communication with the remote server using instructions in Table 2.
- Complete the configuration by using the guidelines inTable 1 or Table 2.
- Click OK. Your entry is added to custom list displayed at the bottom of the page.
| Note: To use a custom feed, apply it to the source or destination address in a firewall rule. In the firewall rule, you can filter addresses to show Infected Hosts, Dynamic Addresses, Whitelists and Blacklists. |
Use the fields in Table 1 to add custom feeds.
Table 1: Fields on the Custom Feeds Page, Feeds with Local Files
Field | Description |
|---|---|
Name | Enter a unique string that must begin with an alphanumeric character and can include colons, periods, dashes, and underscores; no spaces allowed; 63-character maximum. |
Description | Enter a description for your custom feed; maximum length is 1,024 characters. You should make this description as useful as possible for all administrators. |
Custom List | Do one of the following:
Manually enter your item in the space provided in the Custom List section. To add more items, click + to add more spaces. For syntax, enter an IPV4 address in standard four octet format. CIDR notation and IP address ranges are also accepted. Any of the following formats are valid: 1.2.3.4, 1.2.3.4/30, or 1.2.3.4-1.2.3.6. |
Table 2: Fields on the Custom Feeds Page, Feeds with Remote File Server
Field | Description |
|---|---|
Name | Enter a unique string that must begin with an alphanumeric character and can include colons, periods, dashes, and underscores; no spaces allowed; 63-character maximum. |
Description | Enter a description for your custom feed; maximum length is 1,024 characters. You should make this description as useful as possible for all administrators. |
Type of Server URL | Select one of the following:
|
Server File URL | Enter the URL for the remote file server. |
Username | Enter the credentials for the remote file server. |
Password | Enter the credentials for the remote file server. |
Update Interval | Select how often updates are retrieved from the remote files server: Hourly, Daily, Weekly, Monthly, Never |
