You can upload up to 30 unique feeds to the Central Management System appliance from a flat file or an XML-based file in STIX 1.2 format. Configure a combined maximum of 25,000 custom blacklist entries on all of the feeds by specifying each blacklist entry on a separate line. A unique name is required for each feed. The feed name that you specify appears as the malware name in the Alerts > Alerts > Alerts page on the managed Network Security appliance. For details about how to view the details of a custom feed, see Viewing third-party feed details .
Trellix recommends that you make sure that there are no invalid or duplicate blacklist entries so that you do not reach the allotted limit.
Follow these guidelines when you create a blacklist:
Trellix recommends that you specify only public IP addresses in the custom blacklist.
Trellix recommends that you create the list of URLs in an ASCII text file. The maximum number of characters is 2500 for all URLs.
Import STIX 1.2 files. The domain entries in STIX 1.0.1 are not supported.
Trellix recommends that you upload third-party feeds that contain only a
.txtfile extension because incorrect file extensions can cause problems when creating a feed.Specify URL entries in the custom blacklist at the subdirectory level (for example,
http://test.com/testfolder1/1.html). Malicious URLs are not blocked if they are specified at the directory level (for example,http://test.com/testfolder1/).
To include an optional comment string as part of your feed entry, follow these guidelines:
Begin the comment with
<feed>#No spaces are allowed before the hash sign.
ASCII characters only.
Maximum characters of 62.
Comments are not supported in STIX files.
Use the Upload Feed page to import a custom blacklist specific to the following types of content:
IP addresses—A custom list of remote addresses. You can specify the list of IP addresses in a flat file. The IP address feed file is used as a flat file and provides the same functionality as the corresponding XML-based file in STIX format.
Domain Names—A custom list that contains the entries of known suspicious or malicious domains. You can specify the list of domains in a flat file. The domain feed file is used as a flat file and provides the same functionality as the corresponding XML-based file in STIX format.
URLs—A custom list that contains entries of known suspicious or malicious URLs. You can specify the list of URLs in a flat file. The URL feed file is used as a flat file and provides the same functionality as the corresponding XML-based file in STIX format.
Hash Files—A custom list that contains entries of known suspicious or malicious files that are represented as a list of MD5 or SHA-256 hashes in a flat file. The hash feed file is used as a flat file and provides the same functionality as the corresponding XML-based file in STIX format.
Important
You cannot import hash files on Trellix NX 10000 models that are managed by the Central Management System appliance.
STIX—A shared list of suspected malicious URL indicators, list of IP address indicators, list of domain indicators, and list of indicators with MD5 and SHA-256 hashes of malicious files. You can upload a standard STIX 1.2 file in place of the other four feed files.