Enabling or disabling the local IOC feed on a specific appliance using the CLI

The local feed is enabled or disabled for a specific managed appliance only by enabling or disabling the third-party feed for the specific appliance.

A Central Management System appliance cannot distribute indicators of compromise (IOCs) to managed SmartVision Edition sensors.

To enable the local feed for a specific managed Network Security appliance:

Enable CLI configuration mode.

cm-hostname > enable
cm-hostname # configure terminal

Enable local signature generation settings. The local feed does not work if this is not enabled. By default, local signature generation is already enabled.
```
cm-hostname (config) # localsig enable
```
Enable IOCs from a third-party feed for a managed Network Security appliance.
```
cm-hostname (config) # custom content enable on lms <applianceID>
```
where <applianceID> is the Network Security appliance record name. This third-party feed identifies the managed appliance for the local feed. The local feed does not work if this third-party feed is not enabled.

Enable IOCs from the local feed.

cm-hostname (config) # localsig localfeed enable

Verify the status of IOC customizations.

cm-hostname (config) # show custom content enable status

CMS status
        CM-1 : enabled

LMS status
        B9-vNX2500-1 : enabled

Verify the status of the local IOC feed.

CMS1 > show localsig
LocalSig Generator
      Enabled : YES
      Running : running
Rule Versions : 1
 Active rules : 1337
    LocalFeed : Enabled

To disable the local feed for a specific managed Network Security appliance:

Enable CLI configuration mode.

cm-hostname > enable
cm-hostname # configure terminal

Disable IOCs from a third-party feed for a specific managed Network Security appliance. When you disable IOCs from a third-party feed for a managed appliance, the IOCs from the local feed for the appliance are also disabled.
```
cm-hostname (config) # no custom content enable on lms <applianceID>
```
where applianceID is the Network Security appliance record name.
Save your changes.
```
cm-hostname (config) # write memory
```
Log in to the CLI on the managed Network Security appliance.

Enable CLI configuration mode.

nx-hostname > enable
nx-hostname # configure terminal

Verify the status of third-party IOC feeds.

nx-hostname (config) # show custom content enable status
Custom content : disabled