What's happen when FortiAnalyzer IOC Subscription is expired.

[tsunkung]

Just upgraded FortiGate to 7.2.9 from 7.0.14. Just noticed that there are some new feature about Compromised Host. But it required My FAZ to have IOC subscription license. So, I wonder Does IOC license's expiration affect to our production if it's expired likes UTP License. If it's expired, it affect to my policy rule if it use Webfilter Profile.

[johnathan]

If the IOC license on the FortiAnalyzer expires, the FortiAnalyzer just wouldn't be able to recognize the IOCs and everything would pass through. It shouldn't create an issue on your policy. 

[mrafat]

Hi, 

If IOC got expired , the FAZ will not be getting the latest updated TIDB , and hence the FAZ won't be aware of the recent updates for any new published compromises and that's it
This is similar to the situation where you have no license at all for IOC, the TIDB that will be there in FAZ will be the default one which is not up to date  and  doesn't match the new updates for whats considered to be compromised and whats not

This is the only effect from FAZ prespective