Creating a custom blacklist from third-party feeds

You can create a custom blacklist by combining IOCs from the uploaded third-party feeds into a flat file or XML-based file in STIX format.

The details about each custom feed can be accessed from the Alerts > Alerts > Alerts page of the Web UI. Each feed is listed as the malware name. For details, see Viewing custom feed details using the Web UI.

Guidelines for building a custom blacklist

A custom blacklist can combine up to 25,000 IOCs by specifying each blacklist entry on a separate line of a flat file or XML-based file in STIX format.
To avoid exceeding the maximum supported number of IOCs, make sure there are no invalid or duplicate entries in the custom blacklist.
IP address indicators—Specify only public IP addresses in the custom blacklist.
URL indicators—Create the list of URLs in an ASCII text file. The maximum number of characters is 2500 for all URLs.
Domain indicators in STIX files—Import STIX 1.2 files. Domain entries in STIX 1.0.1 are not supported.
Upload third-party feeds that contain only a .txt file extension because incorrect file extensions can cause problems when creating a feed.
Specify URL entries in the custom blacklist at the subdirectory level (for example, http://test.com/testfolder1/1.html). Malicious URLs are not blocked if they are specified at the directory level (for example, http://test.com/testfolder1/).
To include an optional comment in a feed entry, follow these guidelines:
- Comments are not supported in STIX files.
- Use up to 62 ASCII characters only.
- Begin the comment with <feed>#
- No spaces are allowed before the hash sign.

Guidelines for Importing a custom blacklist

Use the Upload Feed page to import a custom blacklist specific to the following types of content:

IP addresses—A custom list of remote addresses. You can specify the list of IP addresses in a flat file. The IP address feed file is used as a flat file and provides the same functionality as the corresponding XML-based file in STIX format.
Domain Names—A custom list that contains the entries of known suspicious or malicious domains. You can specify the list of domains in a flat file. The domain feed file is used as a flat file and provides the same functionality as the corresponding XML-based file in STIX format.
URLs—A custom list that contains entries of known suspicious or malicious URLs. You can specify the list of URLs in a flat file. The URL feed file is used as a flat file and provides the same functionality as the corresponding XML-based file in STIX format.
Hash Files—A custom list that contains entries of known suspicious or malicious files that are represented as a list of MD5 or SHA-256 hashes in a flat file. The hash feed file is used as a flat file and provides the same functionality as the corresponding XML-based file in STIX format.
STIX—A shared list of suspected malicious URL indicators, list of IP address indicators, list of domain indicators, and list of indicators with MD5 and SHA-256 hashes of malicious files. You can upload a standard STIX 1.2 file in place of the other four feed files.