Visibility of Well-Known Malicious IPv4 Addresses

The Secure Workload threat intelligence data packs are updated every 24 hours with well-known malicious IPv4 addresses. Traffic originating from a consumer or provider is analyzed against these malicious IPv4 addresses. This analysis helps identify workloads connecting to these malicious IPv4 addresses, on the Flow Search page. To filter flows connecting to well-known malicious IPv4 addresses, use the following query:

Malicious? = true, Provider Malicious? = true, or Consumer Malicious? = true

To enable the feature to identify well-known malicious IP addresses, contact Cisco Technical Assistance Center.

The Malicious inventories filter is automatically created and populated from the datapack downloads. You can use this inventory filter to create, analze, and enforce policies on your workloads to block traffic from malicious IPv4 addresses. For more information, see Create and Discover Policies and Enforce Policies.

You cannot view the contents of the inventory filter because it is continuously updated with the most significant threats from the datapack.