FAUDE and Global Cache local intel feeds allow appliances to improve detection without overriding their one-way sharing Content Updates licenses, and without directly accessing FAUDE or the Global Cache (also known as AVSuite).
FAUDE publishes a list of SHA256 hashes from malicious URLs it detected over the last seven days. The Global Cache publishes a list of SHA256 hashes from malicious objects it detected over the last seven days. The appliance automatically imports each list as a local intel feed through regular security content updates, and then checks each suspicious URL and object it inspects against the hashes in the lists.
Note
For security and privacy, the lists include only hashes, not URLs or object names.
FAUDE and local Global Cache local intel feeds are both enabled by default.
To view the signature , source and other details of an SHA-256 hash file, use the show analysis intel sha256 <sha256> command.