Feedback MSP version 2.1.0 - Categories and default target lists in reports

Follow

Braedach

• August 31, 2023 02:40
• Edited

Hello,

First of all - I love the update to the MSP portal especially the reports.

However other than a timestamp issue that I have reported I have the following feedback.

The default target lists in the portal do not have a category.
Due to the upgrade, I can now search for these using the category field - eg.. TOR
In fact rules do not have a category
For example - geofencing rules - should have a category like, well - geoblock.

Can we please give consideration to tagging these target lists appropriately and expand the list of categories available.

I would also be like to create my own target lists beyond the 2000 line limit which to be honest is a little unrealistic, since most lists available via GitHub and other sources are extremely large.

Anyhow, I might now be able to find that pesky TOR device if you consider the first proposal.  Other than that, I will continue to explore these new features.

Thanks for your consideration.

Kind Regards

0

• 

  Firewalla

  • August 31, 2023 02:40

  Thank you so much for your feedback!

  Let me forward this to our designers and get back to you.

  As for the target list, do you have anything in mind to import? We are pretty careful with external lists because:

  1. Firewalla already has a huge list. Most of the time, you don't need to import your own.

  2. It is hard to guarantee quality if you are importing your own (quality: the list is well maintained). If you have a quality list, we can import it for sure.

   

  0

  Comment actions Permalink
• 

  Braedach

  • August 31, 2023 03:02
  • Edited

  Hello,

  Yep the URLHaus list and it should be in a format readily usable by firewalla.
  However, there are 2'670'019 malicious URLs tracked on URLhaus.

  Before I moved to the MSP trial the old portal showed an intel feed of about 1.5 million, I think.

  Bit of a shortfall - please don't take offense.  Case in point here - but maybe beyond the scope of this discussion

  - URLhaus | Browse (abuse.ch)

  - URLhaus | API (abuse.ch) - this would be the better option I assume for firewalla

  Still experimenting with your new functionality.
  
  Thanks

   

  0

  Comment actions Permalink
• 

  Firewalla

  • August 31, 2023 16:20

  At the time of my posting, the intel size we have is 114234666, or 114 million; (even the porn sites we track is bigger than 1 million)

  I've forward your suggested list already. 

  0

  Comment actions Permalink
• 

  Braedach

  • September 01, 2023 04:32

  Roger on all the above.

  Very good to know - bit of a black box is your intelligence feed - maybe a good topic for a post.

   

  Thanks for your patience.

   

  0

  Comment actions Permalink

Please sign in to leave a comment.