Deploy with confidence

Use this example to enforce the deployed block lists and an optional allowlist at connection time.

when CLIENT_ACCEPTED {
    set client_ip [IP::client_addr]
    # Check if client IP is in either blocked data group
    if {
        [class match $client_ip equals blocked_ips_general] ||
        [class match $client_ip equals blocked_ips_sensitive]
    } then {
        log local0. "Blocked IP: $client_ip matched a block list"
        reject
        return
    }

    # Allow only known good IPs (optional: whitelist logic)
    if { ![class match $client_ip equals allowed_ips] } {
        log local0. "Connection denied: $client_ip not in allowed_ips"
        reject
        return
    }

    log local0. "Connection allowed: $client_ip"
}

Configure the feed as an External Resource, then reference it in a Web Filter profile (URL category) or firewall policy (IP address feed).

config system external-resource
    edit "tag-insights-url-rep"
        set type category
        set resource "https://feedlists.magnetoai.com/<your-feed-path>"
        set refresh-rate 5
        set category 195
    next
end

Add the feed as an External Dynamic List, then reference it in a Security Policy or URL Filtering profile.

set shared external-list tag-insights-url-rep type url url "https://feedlists.magnetoai.com/<your-feed-path>"
set shared external-list tag-insights-url-rep type url recurring five-minute

In Firepower Management Center: Objects > Object Management > Security Intelligence > Network Lists and Feeds (or URL Lists and Feeds), add a feed pointed at your MagnetoAI feed URL, set an update interval, then add it to the Security Intelligence tab of your access control policy.

Via Security Director / Juniper ATP Cloud: Configure > Threat Prevention > Custom Feeds, add a Custom Feed of type IP or URL pointed at your MagnetoAI feed URL and set a refresh interval, then apply it in a security policy or firewall rule.

In Forcepoint Security Manager: Policy Management > Filters > Edit Custom Category, import the list from your MagnetoAI feed URL on a recurring schedule, then apply the category in your web policy.

In the iBoss console: Policies > Custom Categories, add a URL-based custom category sourced from your MagnetoAI feed URL, or use the iBoss REST API to pull scheduled updates.

Add the feed as a custom Threat Intelligence source (STIX/TAXII or Cloud Signaling) in AED, or apply it as a static IP blocklist countermeasure, refreshed on your configured interval.

In the Sightline/TMS console, add the feed as an external IP blocklist source for a Fingerprint Filter countermeasure, refreshed on your configured interval.

Configure a class-list object referencing your MagnetoAI feed URL, then reference the class-list in a network ACL or DDoS mitigation policy.

class-list tag-insights-url-rep
  file uri "https://feedlists.magnetoai.com/<your-feed-path>"
  periodic 300