Before
An analyst would repeatedly download the latest botnet indicator dump, filter it for relevant confidence and threat types, extract the IP addresses, and remove duplicates. They would then retrieve the current firewall list, reconcile the new indicators with existing entries, format the result, and manually update the blacklist.
How it works
- On a recurring schedule, retrieve the latest IP-and-port indicators and filter them for high-confidence botnet command-and-control activity.
- Extract unique IPv4 addresses, format them as blacklist items, and combine them with the existing firewall entries.
- Replace the selected firewall list with the consolidated, deduplicated set of botnet IP addresses.
Workflow details
- Scheduled collection: The workflow runs on a predetermined schedule and downloads the latest available IP-and-port additions from ThreatFox.
- Threat filtering: It keeps indicators associated with botnet command-and-control activity, limits them to confidence levels of 75 or 100, extracts IPv4 addresses, and removes duplicate values.
- Firewall preparation: The resulting IP addresses are converted into the item format required by the firewall blacklist.
- List reconciliation: The workflow retrieves the existing firewall lists and their current items, then combines the new indicators with the current blacklist while retaining only unique IP addresses.
- Blacklist update: The consolidated list is written back to the selected firewall list, keeping the blacklist aligned with the latest qualifying botnet indicators without requiring a manual download, cleanup, or update cycle.
What changed
The firewall blacklist is now refreshed automatically on a defined schedule, with indicator filtering, IPv4 extraction, deduplication, list reconciliation, and the final update performed without a manual handoff.
Work removed
Downloading the latest indicator dump, filtering records by confidence and threat type, extracting IPv4 addresses, removing duplicates, retrieving the current firewall list, merging entries, formatting blacklist items, and submitting the updated list.
Expected outcome
Each scheduled run can eliminate at least five recurring manual handling steps while keeping the blacklist populated with the latest qualifying botnet IP indicators.
