Duplicate, please ignore - How to efficiently and regularly add blocked sites to 40+ FB mgmt by WSM

Logan5Logan5
edited June 2020 in Firebox - Management Software

Duplicate, please ignore -

I am looking for a better way to add/manage "Blocked sites ..." on more than 40 Fireboxes.

I want to be able to react to information like:
"Ryuk Ransomware is spread via the initial Trickbot installs through newly identified Cobalt Strike Domains." and quickly add the "Cobalt Strike Domains" to the block list.

The Fireboxes are managed by a Watchguard System Manager server. WSM does not manage "Blocked sites ..." (it would be great if it did) and Watchguard CLI cannot be used on WSM managed Fireboxes. It is also not advisable to manually order policies that use WSM templates. So making my own catchall block policy as the first policy probably would not work either, since it would auto order incorrectly.

Please let me know your thoughts.

Thank you for your time.

Sign In to comment.