Updated Threat Intelligence Feeds from ZeroFox
To provide increased accuracy for risk evaluation of users and assets, Exabeam can now leverage threat intelligence feeds from ZeroFox (ZF) across Exabeam products. The ZeroFox feeds provide improved information for indicators of compromise (IoCs) such as IP addresses associated with ransomware and malware attacks.
In most cases, no configuration change is required to begin utilizing ZeroFox threat intelligence. However, if you previously disabled rules or models that utilize the new feeds, you will need to enable them to utilize the new feeds.
The following table displays the rules that leverage the ZeroFox threat intelligence feeds by IoC category:
IoC Category | Rules |
|---|---|
(ZF) IP addresses associated with ransomware attacks |
|
(ZF) IP addresses associated with ransomware or malware attacks |
|
(ZF) Domain names and URLs associated with sites that often contain malware, drive-by compromises, and more |
|
(ZF) Domain names associated with phishing or ransomware | WEB-UD-Phishing |