Additional Subscriptions

• 1: Dynamic Blocklist
• 1.1: Dynamic Block List Configuration Guides
• 1.1.1: Cisco Firepower DBL Configuration Guide
• 1.1.2: McAfee Web Gateway (Skyhigh Secure Web Gateway) DBL Configuration Guide
• 1.1.3: Palo Alto Networks DBL Configuration Guide
• 1.1.4: Squid DBL Configuration Guide
• 1.1.5: Zscaler Internet Access DBL Configuration Guide

1 - Dynamic Blocklist

Dynamic Blocklist (DBL) is a feature included with Samurai MDR. The list is a feed of high fidelity indicators of compromise (IOC) which when subscribed to by a supporting device, provides the ability to block traffic to the identified threat actor. Typical devices which can make use of DBL include Secure Web Gateways (SWG) and Next Generation Firewalls (NGFW).

The DBL contains IP addresses, domain names and Uniform Resource Locators (URLs) of servers hosting malware, exploits, botnet Command and Control (C&C) servers and other known malicious activity.

Feeds are updated hourly and as emerging threats are discovered. Devices which are subscribed to the DBL will receive updated IoCs at the next “push” or “pull” event, depending on the manufacturer.

Our high fidelity IoCs contained in the Dynamic Blocklist originate from sources including:

• NTT’s proprietary Threat Intelligence data sources
• IoCs based on security incident investigations from all clients subscribed to NTT’s threat detection services
• Threat Intelligence obtained via partner intelligence relationships
• Open Source Intelligence feeds which have been analyzed and vetted by NTT
• NTT analysis tools which detect malicious websites (especially phishing and fraud) and extract intelligence of phishing reports from social media.

Onboarding

During the MDR onboarding or during service, the client can choose to enable DBL.

If the client elects to enable DBL and has Supported Devices:

• The client must submit a DBL Request via the Samurai MDR portal
• Include the relevant information required within the request as outlined within the DBL Configuration Guide
• Once access has been enabled, the client will be notified via the ticket with relevant configuration information.
• The client may then proceed with configuration of their devices as per the relevant DBL Configuration Guide

Supported Devices

NTT provides configuration guides to assist the Client in configuring Dynamic Blocklist on supported devices. The following device types are currently supported:

• McAfee WebGateway (Skyhigh Secure Web Gateway)
• Palo Alto Networks NGFW
• ZScaler Internet Access (ZIA) - Proxy
• Squid proxy
• Cisco Firepower

Depending on the capabilities of individual device types, DBL will be configured using one of two possible methods:

• “pull”: In a “pull” configuration the device is set up to connect to NTT’s servers and fetch the threat feed. The frequency of retrieval is dependent on the device configuration.
• “push”: In a “push” configuration the device is set up to receive connections from NTT’s servers in order to receive the threat feed. The frequency with which the threat feed is pushed to the client device is usually determined by the configuration of the client device.

If the client is interested in using DBL with a device that is currently not supported, this can be discussed with NTT during onboarding.

Connectivity Requirements

In addition to configuring the devices for DBL, the client will also need to ensure that Internet connectivity is in place:

• for devices using a “pull” configuration, outbound TCP connections to the DBL server, typically on port 443.
• for devices using a “push” configuration, inbound TCP connections are possible from DBL servers to the client device.

NTT will provide the client with the DBL server IP addresses and/or URLs and other relevant details of the via the ‘DBL On-boarding request’ ticket.

1.1 - Dynamic Block List Configuration Guides

1.1.1 - Cisco Firepower DBL Configuration Guide

The guide outlined steps to automatically integrate DBL with Cisco Firepower. The maximum list size for DBL is 20,000. This maximum is subject to change without notice due to device specifications and performance.

Submit a ticket

To continue with this configuration guide you must first submit a ticket via the Samurai MDR portal. Add the following information within your request:

Submit the ticket and you will hear back from us with additional information (e.g DBL URL) to continue with the configuration below.

Connection Requirements

You will need to ensure your Firepower device(s) can reach a specific URL to obtain the DBL. This information will be provided to you once subscribed.

Table 1: Connections requirements

To complete this integration you have to:

• Have submitted a ticket via the Samurai MDR portal and have been provided the necessary DBL endpoint URL/IP address.

From your Cisco Firepower Management Console (FMC):

• Create a feed that captures the DBL URLs
• Set Security Intelligence Settings for DBL URL
• Confirm Blocking
• Create a feed that captures the DBL IP list
• Set Security Intelligence Settings for DBL IP

You may also want to refer to the Cisco FMC documentation.

Create a feed that captures the DBL URLs

1. Login to your FMC

2. Click Objects – Object Management

3. Click Security Intelligence – URL Lists and Feeds in the left pane.

4. Click Add URL Lists and Feeds

5. Enter the following information in Security Intelligence for URL List/Feed and click Save

Set Security Intelligence Settings

Set the feed you created in Create a feed that captures the DBL URLsto Security Intelligence.

1. Click Policies – Access Control

2. Select the Policy for which you want to set the Feed

(For example: Select sample-fp-policy as depicted below)

3. If you do not have a Policy, create one from New Policy and follow the procedure

4. Select Security Intelligence

5. Select URLs

6. Select the Feed you created in Create a feed that captures the DBL URLs(our example was ABTI_for_URL)

7. Under Available Zones, select Any and click Add to Block List

8. Click Save

9. Click Deploy

Confirm Blocking

Verify that the test URL is blocked.

1. From a browser that leverages the Cisco Firepower inspection path, access the following test URL:

• http://ameblo.jp/testment12016/entry-12576105325.html

2. Verify that it is blocked. If blocking does not occur check through the configuration again. Our example block screen looks like this:

Create a feed that captures the DBL IP list

1. Click Objects – Object Management

2. Click Security Intelligence – Network Lists and Feeds in the left pane

3. Click Add Network Lists and Feeds

4. Enter the following information in Security Intelligence for URL List/Feed and click Save

Set Security Intelligence Settings for DBL IP

1. Click Policies – Access Control**

2. Select the Policy for which you want to set the Feed

(For example: Select sample-fp-policy as depicted below)

3. If you do not have a Policy, create one from New Policy and follow the procedure

4. Select Security Intelligence

5. Select Networks

6. Select the Feed you created in Create a feed that captures the DBL IP list (our example was ABTI_for_IP)

7. Under Available Zones, select Any and click Add to Block List

8. Click Save

9. Click Deploy

Our Dynamic Block List (DBL) configuration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by *raising a ticket in the Samurai MDR portal and we shall get it updated.

1.1.2 - McAfee Web Gateway (Skyhigh Secure Web Gateway) DBL Configuration Guide

The DBL provides a maximum of 80,000 listings. This limit may be updated without notice.

Submit a ticket

To continue with this configuration guide you must first submit a ticket via the Samurai MDR application. Add the following information within your request:

Submit the ticket and you will hear back from us with additional information (e.g DBL URL’s) to continue with the configuration below.

Connection Requirements

You will need to ensure your Secure Web Gateway can reach a specific URL to obtain the DBL. This information will be provided to you once subscribed.

Table 1: Connections requirements

From your Secure Web Gateway:

• Configure the External Lists Module
• Create a Rule

Configure the External Lists Module

Follow the steps outlined within the Skyhigh Security documentation:

• Configure the External Lists Module

Use the following parameters when completing the steps:

Table 2: External Lists Module

Tip: To find out more information about External Lists refer to Skyhigh Security documentation About External Lists

Create a Rule

Follow the steps outlined within the Skyhigh Security documentation:

• Create a Rule

You need to configure a rule that denies access if the URL requested by the client matches the external list previously created.

Use the following parameters when completing the steps:

Table 3: Rule creation

Our Dynamic Block List (DBL) configuration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by *raising a ticket in the Samurai MDR portal and we shall get it updated.

1.1.3 - Palo Alto Networks DBL Configuration Guide

The DBL is sized at approximately 40,000 URLs. Should memory exhaustion occur due to multiple Profile usage, ensure to manage your device(s) to avoid such a situation by performance and log monitoring.

Submit a ticket###

To continue with this configuration guide you must first submit a ticket via the Samurai MDR portal. Add the following information within your request:

Submit the ticket and you will hear back from us with additional information (e.g DBL URL) to continue with the configuration below.

Connection Requirements

You will need to ensure your Palo Alto Networks device(s) can reach a specific URL to obtain the DBL. This information will be provided to you once subscribed.

Table 1: Connections requirements

To complete this configuration you will need to:

From your Palo Alto Networks device:

• Configure an External Dynamic List (EDL)
• Configure a URL Filtering Profile
• Configure security policy rule

Configure an External Dynamic List (EDL)

Follow the steps outlined within the Palo Alto Networks documentation:

• Configure the Firewall to Access an External Dynamic List

Use the following parameters when completing the steps:

Table 2: EDL Configuration

Tips:

• Select your specific PAN OS version when reviewing Palo Alto Networks documentation (we have linked version 10.2)
• To find out more information about EDL’s refer to Palo Alto Networks documentation External Dynamic Lists
• Once completed, follow the Palo Alto Networks documentation linked to y’Test Source URL’ to ensure the DBL can be accessed

Configure a URL Filtering Profile

Follow the steps outlined within the Palo Alto Networks documentation:

• Configure URL Filtering

Use the following parameters for the EDL created in Configure an External Dynamic List when completing the steps:

Table 3: URL filtering profile

Configure security policy rule

Follow the steps outlined within the Palo Alto Networks documentation:

• Create a Security Policy Rule

Use the following parameters in the Actions tab when completing the steps:

Table 4: Security policy rule

Our Dynamic Block List (DBL) configuration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by *raising a ticket in the Samurai MDR portal and we shall get it updated.

1.1.4 - Squid DBL Configuration Guide

Refer to Squid Documentation as needed: http://www.squid-cache.org/

Submit a ticket

To continue with this configuration guide you must first submit a ticket via the Samurai MDR portal. Add the following information within your request:

Submit the ticket and you will hear back from us with additional information (e.g DBL URL) to continue with the configuration below.

Connection Requirements

You will need to ensure your Squid proxy can reach a specific URL to obtain the DBL. This information will be provided to you once subscribed.

Table 1: Connections requirements

From your Squid Proxy:

• Import the DBL
• ACL Configuration
• Confirm configuration and auto run

Import the DBL

1. Store the DBL list retrieval script as below:

/usr/local/squidList/getSquidACL.sh

2. Back up the script file:

# cp /usr/local/squidList/getSquidACL.sh /usr/local/squidList/getSquidACL.sh.org

3. Open the script file using your favorite editor. In the examples we use “vi” for editing

# vi /usr/local/squidList/getSquidACL.sh

4. Set the DBL URL to import URL list.

(Example)DBL_URL="http://<IP address>/dbl/block_plain.txt"

5. Set the DBL URL to import IP list.

(Example)DBL_IP="http://<IP address>/dbl/block_ip_plain.txt"

6. Rewrite the reboot command to any command which used in production environment.

(Example)restart =/etc/rc.d/init.d/squid restart

7. Set the place to output the URL list

(Example)DBL_URL_OUTPUT="/etc/squid/block_plain.txt"

8. Set the place to output the IP list

(Example)DBL_IP_OUTPUT="/etc/squid/block_ip_plain.txt"

9.Save and close ”vi”

# :wq

10. Give the execute permission to the script.

# chmod 775 /usr/local/squidList/getSquidACL.sh

ACL Configuration

1. Edit the “squid.conf” file

# vi /etc/squid/squid.conf

2. Add ACL setting for the list that set in steps 7 and 8 of the previous section.

(Example)acl blocklist_regex url_regex“/etc/squid/block_plain.txt”acl blockip dst “/etc/squid/block_ip_plain.txt”http_access deny blocklist_regexhttp_access deny blockip

3. Save and close

# :wq

Confirm configuration and auto run

1. Run the DBL retrieval script manually with the following command:

# /usr/local/squidList/getSquidACL.sh

After execution, check your standard Squid logs. If you receive an error, check the status of your network because it is highly likely that the DBL destination URL is not communicating.

2. If there are no errors, set the execute command on Cron. (Following setting is run every 10 minutes.)

*/10 * * * * /usr/local/squidList/getSquidACL.sh

Our Dynamic Block List (DBL) configuration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by *raising a ticket in the Samurai MDR portal and we shall get it updated.

1.1.5 - Zscaler Internet Access DBL Configuration Guide

Follow the steps below and then submit a ticket via the Samurai MDR portal.

Access Requirements

Threat data will be pushed using the Zscaler native API with standard HTTPS TCP/443 to your Zscaler cloud instance.

From Zscaler Internet Access Portal:

• Create a dedicated user for NTT

• Provide your API base URL and API key

• Create a URL category

• Configure URL and Cloud App control

• Configure Monthly Reporting

Once completed you will need to provide specific information to NTT via a ticket in the Samurai MDR portal.

Create a dedicated user with a specific role for NTT

Follow the steps outlined in Zscaler documentation to create an admin role: 

• Adding Admin Roles

Use the following parameters when completing the steps:

Table 1: Admin role

Follow the steps outlined in Zscaler documentation to create a user and assign the role:

• Adding ZIA Admins

Use the following parameters when completing the steps:

Table 2: Admin user

You will need to share these credentials when raising a ticket with us.

Provide your API base URL and API key

Review the Zscaler documentation to find your Base URL and API Key:

• Managing Organization API Keys

You can also read more information about the Zscaler API at:

• https://help.zscaler.com/zia/about-cloud-service-api-key-management

You will need this information when raising a ticket with us.

Create a dedicated URL category for the DBL:

Follow the Zscaler documentation:

• Configuring Custom URL Categories

You need to create two URL categories. Use the following parameters when completing the steps:

Table 3: Custom URL category 1

Table 4: Custom URL category 2

Configure URL and Cloud App control

Follow the steps outlined in Zscaler documentation:

• Configuring the URL Filtering Policy

Use the following applicable parameters when completing the steps (set other parameters according to your specific configuration):

Table 5: URL filtering policy

Configure Monthly Reporting

To enable improvements of DBL we recommend that you schedule monthly reports that are automatically emailed to us. 

Follow the steps in the Zscaler documentation, Refer to Copying a Standard Report:

• Creating or Copying a Report

Select the Blocked Web Traffic Overview under Standard Reports - Web Activity to copy 

Table 6: Copy Report

Follow the steps in Zscaler documentation to Schedule the Report:

• Scheduling Reports

Use the following parameters when completing the steps:

Table 7: Scheduled Report

Submit a ticket

Now that you have completed all of the steps above you must now submit a ticket via the Samurai MDR portal. Add the following information (created from the steps above) within your request:

Submit the ticket and you will hear back from us when onboarding is complete.

Our Dynamic Block List (DBL) configuration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by *raising a ticket in the Samurai MDR portal and we shall get it updated.