Hi Team
Am looking to create outbound rule from firewall to the GCTI IP. So using the below lines in my rule as suggested by the SECOPS. Expecting your support on this for better understanding.
$feed.graph.metadata.entity_type = "IP_ADDRESS"
$feed.graph.metadata.product_name = "GCTI Feed"
$feed.graph.metadata.source_type = "GLOBAL_CONTEXT"
1. I would like to know how to validate the above lines and its values. If i do the UDM search i can able to see the graph.metadata.source_type = "DERIVED_CONTEXT" and not the graph.metadata.source_type = "GLOBAL_CONTEXT"
- Since i have the source type : Mandiant Threat Intelligence. (Refer : Below Snap-2)
3. How i can confirm GCTI feeds are integrated.
4. Is the feeds are updated at any frequency or feeds are updated live.
Snap:1
-
Snap: 2
Regards
Ajay P
Detection Engineering
