This section describes how to enable or disable a Central Management System appliance to receive indicators (IOCs) from a custom feed and distribute them to all managed Network Security appliances or a specific managed Network Security appliance. When the custom IOC feed feature is disabled, DTI feeds are not pushed to all managed Network Security appliances or a specific managed Network Security appliance.
Note
A Central Management System appliance cannot distribute indicators of compromise (IOCs) to managed SmartVision Edition sensors.
You can enable or disable the custom IOC feed features only using the CLI. Third-party feeds are enabled by default when you add the Network Security appliance to the Central Management System appliance. The local feed is disabled by default. DTI feeds are automatically pushed to the managed Network Security appliance.
Enabling third-party feeds or the local feed on the Central Management System appliance can negatively impact the performance of the appliance.
Important
IOC feeds are not supported on integrated Trellix NX 300 models that are managed by the Central Management System appliance.
Note
When the same intel feed is added both to a standalone Network Security appliance and to a Central Management System appliance, and the Network Security appliance is later added to the Central Management System appliance, duplicate feeds are displayed on the Network Security appliance.
Admin access to the Central Management System appliance.
A connection to the Dynamic Threat Intelligence (DTI) Cloud.
Managed Network Security appliance deployed in TAP mode or inline mode.