To manage custom IOC feeds:
Verify that the Malware Analysis appliance is deployed in TAP mode or inline mode.
Note
When the Classic edition Network Security appliance is converted to SmartVision edition, the 3rd Party Feeds option is not available under Settings.
Upload the third-party feed blacklist to the Malware Analysis appliance. For details, see the following topic:
Create a flat file or XML-based file in STIX format that contains custom blacklist entries. Verify the file is accessible from the local desktop from which you access the Malware Analysis Web UI. For details, see the following topic:
View the details of the malware events that matched the custom blacklist. For details, see the following topics: