TIDE Custom RPZ is created using up to five organization-uploaded feeds, each containing its own datasets that are combined into one RPZ feed with filtering applied. Your organization can choose which threat classes and properties are filtered in the RPZ feed. Applying all filters to a custom RPZ feed will get all records pulled from the TIDE database; whether or not this option is available depends on your organization’s subscription plan.
NOTE: When a new indicator is added to an RPZ feed, it generally takes a couple hours for the RPZ to reflect the changes. Sometimes it may take longer.
Viewing Custom RPZ Feeds
To view all custom RPZ feeds created by your organization, do the following:
In the Cloud Services Portal, click Manage > TIDE Data.
On the TIDE Data page, click the Custom RPZ tab, located above the top Action bar. The Custom RPZ page shows the following:
NAME: The name given to the feed when it was created.\
DESCRIPTION: The description provided for the feed when it was created.
FEEDS: The number of feeds included in the feed.
3. In the Details panel, view all information associated with the feed.
4. You can do the following in the Custom RPZ tab:
Click on the horizontal menu icon to select which information columns to display and which to hide.
Click a column header or use the arrow keys to reorder data within a column.
Click the search icon to perform a search.
Click i to open or close the Details panel.
The custom RPZ feed will also be displayed in the list of available feeds under the Feeds and Threat Insight option, when you configure a security policy. For details, see Policy Rules.
Adding Custom RPZ Feed
To add a custom RPZ feed, do the following:
In the Cloud Services Portal, click Manage > TIDE Data.
On the TIDE Data page, click the Custom RPZ tab, located above the Action bar.
On the Custom RPZ page, click Add Custom RPZ in the Action bar.
On the Add Custom RPZ List page, specify the following:
Feed Name: For each custom list, enter a unique name that is from 3 to 48 characters in length and consists of lowercase letters and of “-“ and “_” characters.
Description: Enter a brief description for the feed.
Data Sources: Select one or all of the data types:
Infoblox Curated Data: Data curated and provided by the Infoblox Cyber Intelligence team.
Infoblox 3rd Party Data: Data provided by Infoblox’s third-party provider.
Your Uploaded Data: Data owned and curated by your own organization and uploaded as a custom RPZ feed. For details, see Submitting TIDE Data.
Click Select Class/Property: Do one of the following:
Add one or more classes or properties to your RPZ feed. Or, add all available classes and properties. With Select All, you will add all database records to your custom RPZ feed.
If at any time you are not satisfied with your selections, click Unselect All to begin the selection process again.
When creating a custom RPZ feed, do keep in mind the maximum size limit of 6 million records. For information on RPZ feed sizing information, see the Sizing Guidelines for Custom RPZ Feeds.
The following attributes will be listed for each class or property added to the custom RPZ feed:
CLASS/PROPERTY: The name of the class or property added to the custom RPZ feed.
TYPE: The type of data added to the RPZ feed. Select Host, IP, or All. All is selected by default.
MIN CONFIDENCE: The minimum confidence level for data included in the RPZ feed. Select Info, Low, Medium, or High. Medium is selected by default.
MIN SEVERITY: The minimum severity level for data included in the RPZ feed. Select Info, Low, Medium, or High. Medium is selected by default.
5. Click Save & Close to save your configuration.
Editing a Custom RPZ Feed
To edit an existing custom RPZ feed, do the following:
On the TIDE Data page, click the Custom RPZ tab.
Select the custom RPZ feed to be edited.
Click Edit.
On the Add Custom RPZ List page, make edits as desired.
Click Save & Close.
Removing a Custom RPZ Feed
Warning: This action is irreversible.
To remove a custom RPZ feed, do the following:
On the TIDE Data page, click the Custom RPZ tab, located above the Action bar.
Select the RPZ feed to be edited.
Click Remove in the Action bar.