How to use the Fortiguard Malware IP List in Fortigate policies?

[whang]

We have a Fortigate cluster and a FortiSIEM. In the FortiSIEM, there's a 'Fortiguard Malware IP List' which is dynamically updated. How can we use this (as an External Connector) in the Fortigate to block connections to those IPs? I can't find where the FSM is getting the list.

[kumarh]

In Intrusion Prevention profiles, you can can Block "Scan Outgoing Connections to Botnet Sites" and enable this profile in firewall policy.

[akushwaha]

Hi ,
To block external Threat list via Firewall policy, please refer to the below article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-External-threat-list-threat-feed-blocked-v...

Regards,
Abhimanyu