External BotNet Lists in AMP Profil or IPS Sensor?

[scheuri]

Hello all

Is it possible to add (external/thirdparty) lists of BotNet IP addresses in the AMP/AV profile or the IPS sensor?

As far as I can see it is possible to add thirdparty/external AV-Lists, however, I am not sure if AMP/AV does check IP addresses or if those thirdparty/external AV-Lists need to be AV signatures.

As far as I can see there is no option in the IPS profile/sensor to add external lists.

So my best guess at the moment is, that it this is no possible - did someone do this by any chance and can confirm that it indeed might be possible?

Thanks a lot, much appreciated

[AlexC-FTNT · Accepted solution]

Starting with FortiOS 6.2, you can add an external list of IPs or domains that you want to block:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-External-threat-list-threat-feed-blocked-v...

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/9463/threat-feeds

Is this what you are looking for?

[scheuri]

Thank you AlexC for both links.

I was indeed not aware that one can use external lists in the firewall policy itself as source or destination.
The second link I already was aware of and if I am reading that article correctly, then an external threat feed containing IP addresses can be used in the DNS filter (security profile), but none other (such as AV, IPS, etc.).

Thank you for the first linke and for confirming my assumption.
Much appreciated