These procedures describe how to enable or disable a Central Management System appliance to receive indicators (IOC) from a third-party feed and distribute them to all managed Network Security appliances.
Note
A Central Management System appliance cannot distribute indicators of compromise (IOCs) to managed SmartVision Edition sensors.
To enable a third-party feed for all managed Network Security appliances:
Log in to the Central Management System CLI.
Enable CLI configuration mode.
cm-hostname > enable cm-hostname # configure terminal
Enable IOCs from a third-party feed for all managed Network Security appliances.
cm-hostname (config) # custom content enableVerify the status of third-party IOC feeds.
cm-hostname (config) # show custom content enable status CMS status CM-1 : enabled LMS status B9-vNX2500-1 : enabled B9-vNX6500-1 : enabled Bolt : enabled SystemVX12500-1 : enabled SystemVX12500-2 : enabledSave your changes.
cm-hostname (config) # write memory
To disable a third-party feed for all managed Network Security appliances:
Log in to the Central Management System CLI.
Enable CLI configuration mode.
cm-hostname > enable cm-hostname # configure terminal
Disable IOCs from all third-party feeds on the CM.
cm-hostname (config) # no custom content enableVerify the status of IOC customizations.
cm-hostname (config) # show custom content enable status CMS status CM-1 : disabled LMS status B9-vNX2500-1 : enabled B9-vNX6500-1 : enabled Bolt : enabled SystemVX12500-1 : enabled SystemVX12500-2 : enabledSave your changes.
cm-hostname (config) # write memory