Enabling or disabling third-Party IOC feeds on a specific appliance using the CLI

These procedures describe how to enable or disable a Central Management System appliance to receive indicators (IOC) from a third-party feed and distribute them to a specific managed Network Security appliance.

Note

A Central Management System appliance cannot distribute indicators of compromise (IOCs) to managed SmartVision Edition sensors.

You can verify that this feature is disabled when you log in to the managed Network Security appliance.

To enable a third-party feed for a specific managed Network Security appliance:

Enable CLI configuration mode.

cm-hostname > enable
cm-hostname # configure terminal

Enable IOCs from a third-party feed for a managed Network Security appliance.
```
cm-hostname (config) # custom content enable on lms <applianceID>
```
where applianceID is the Network Security appliance record name.

Verify the status of IOC customizations.

cm-hostname (config) # show custom content enable status

CMS status
        CM-1 : enabled

LMS status
        B9-vNX2500-1 : enabled

Save your changes.
```
cm-hostname (config) # write memory
```

To disable a third-party feed for a specific managed Network Security appliance:

Enable CLI configuration mode.

cm-hostname > enable
cm-hostname # configure terminal

Disable IOCs from a third-party feed for a specific managed Network Security appliance.
```
cm-hostname (config) # no custom content enable on lms <applianceID>
```
where applianceID is the Network Security appliance record name.
Save your changes.
```
cm-hostname (config) # write memory
```
Log in to the CLI on the managed Network Security appliance.

Enable CLI configuration mode.

nx-hostname > enable
nx-hostname # configure terminal

Verify the status of third-party IOC feeds.

nx-hostname (config) # show custom content enable status
 
Custom content : disabled