Wednesday, 17 June 2020

Firepower check Security Intelligence feed contents

You can view the list of Security Intelligence IP addresses from the CLI of the Defense Center. You'll want to issue the following commands after logging in:

1. sudo su

2. cd /var/sf/iprep_download

In this directory, there is a file called rep_dd.yaml. You can view this text file to find the UUID associated with each category, such as "attackers".

There should be a file in the /var/sf/iprep_download directory named for that UUID, for example 5a0b6d6b-e2c3-436f-b4a1-48248b330a26. You can view this file using the "less" command in order to see the IP addresses that are currently included for that particular category.