Enabling or disabling the local feed on all appliances using the CLI

These procedures describe how to enable and disable a Central Management System appliance to receive indicators (IOCs) from the local feed and distribute them to all managed Network Security appliances.

Note

A Central Management System appliance cannot distribute indicators of compromise (IOCs) to managed SmartVision Edition sensors.

Note

Enabling the local feed on the Central Management System appliance can negatively impact the performance of the appliance.

The local feed only provides data when there are actual alerts.

To enable the local feed for all managed Network Security appliances:

Enable CLI configuration mode.

cm-hostname > enable
cm-hostname # configure terminal

Enable local signature generation settings. The local feed does not work if this is not enabled. By default, local signature generation is already enabled.
```
cm-hostname (config) # localsig enable
```
Enable IOCs from a third-party feed for all managed Network Security appliances. The local feed does not work if third-party feeds are not enabled.
```
cm-hostname (config) # custom content enable
```

Enable IOCs from the local feed.

cm-hostname (config) # localsig localfeed enable

Verify the status of third-party IOC feeds.

cm-hostname (config) # show custom content enable status

CMS status
        CM-1 : enabled

LMS status
        B9-vNX2500-1 : enabled
        B9-vNX6500-1 : enabled
        Bolt : enabled
        SystemVX12500-1 : enabled
        SystemVX12500-2 : enabled

Verify the status of the local feed.

CMS1 > show localsig
LocalSig Generator
      Enabled : YES
      Running : running
Rule Versions : 1
 Active rules : 1337
    LocalFeed : Enabled

Save your changes.
```
cm-hostname (config) # write memory
```

To disable the local feed for all managed Network Security appliances:

Enable CLI configuration mode.

cm-hostname > enable
cm-hostname # configure terminal

You can disable IOCs from the local feed in a number of ways:
- Disable IOCs from the local feed on the CM.
```
cm-hostname (config) # no localsig localfeed enable
```
- Disable IOCs from all third-party feeds on the CM. When you disable IOCs from the third-party feeds, the IOCs from the local feed are also disabled.
```
cm-hostname (config) # no custom content enable
```
- Disable local signature generation settings. When you disable local signature generation settings, the IOCs from the local feed are also disabled.
```
cm-hostname (config) # no localsig enable
```

Verify the status of third-party IOC feeds.

cm-hostname (config) # show custom content enable status

CMS status
        CM-1 : disabled
LMS status
        B9-vNX2500-1 : enabled
        B9-vNX6500-1 : enabled
        Bolt : enabled
        SystemVX12500-1 : enabled
        SystemVX12500-2 : enabled

Verify the status of the local IOC feed.

CMS1 > show localsig
LocalSig Generator
      Enabled : YES
      Running : running
Rule Versions : 1
 Active rules : 1337
    LocalFeed : Disabled

Save your changes.
```
cm-hostname (config) # write memory
```