Security Intelligence Feeds for Firepower Security Intelligence Policies
The following table describes the categories available in the Cisco Talos feeds. These categories can be entered in both the network and URL blocked list.
Category |
Description |
---|---|
attackers |
Active scanners and block-listed hosts known for outbound malicious activity. |
bogon |
Bogon networks and unallocated IP addresses. |
bots |
Sites that host binary malware droppers. |
CnC |
Sites that host command-and-control servers for botnets. |
dga |
Malware algorithms used to generate a large number of domain names acting as rendezvous points with their command-and-control servers. |
exploitkit |
Software kits designed to identify software vulnerabilities in clients. |
malware |
Sites that host malware binaries or exploit kits. |
open_proxy |
Open proxies that allow anonymous web browsing. |
open_relay |
Open mail relays that are known to be used for spam. |
phishing |
Sites that host phishing pages. |
response |
IP addresses and URLs that are actively participating in malicious or suspicious activity. |
spam |
Mail hosts that are known for sending spam. |
suspicious |
Files that appear to be suspicious and have characteristics that resemble known malware. |
tor_exit_node |
Tor exit nodes. |