Tecnical Tip: Identifying threat feeds by MAC address

[VinayHM]

Description	This article describes how to identify a threat feed by using the MAC address in the external connectors.
Scope	FortiGate, FortiOS 7.4.0 and above.
Solution	In older versions of FortiOS, threat feeds use the following: Domain. Malware. IP address. FortiOS versions 7.4.0 and above allows for checking a threat feed by MAC address. To use this feature: Go to Security Fabric -> External Connectors and select Create New. In the Threat Feeds section, select MAC Address. Set the Name to MAC_List. Set the Update method to External Feed. Set the URL of the external resource to http://X.X.X.X/external-resources/Ext-Resource-Type-as-Address-mac-1.txt. Configure the remaining settings as required, then select OK. To apply a MAC address threat feed in a policy: Select a policy. In the 'source' field, select MAC list from the list. Select Apply.