Block all IPs on known Abuse list

Hi April,

Thank you for reaching out to Sophos Community.

Have you tried the Adding Custom IPS signature? 

docs.sophos.com/.../index.html

The link you sent makes absolutely no sense to me.

Do you use Sophos MDR? 

Sophos still uses a own blocklist via ATP. This list is provided by SophosLabs. See: https://support.sophos.com/support/s/article/KB-000035750?language=en_US

Sophos MDR (Threat Analyst) will also provide this kind of integration. 

Yes we use MDR. That was already enabled.

Hi,

please post a copy of your country blocking rule.

Ian

My block by country rule works just fine now that I edited it to not come from WAN. I would prefer to block known abuse IPs instead of all traffic from a country so we can do business from valid countries.

Hi,

thank you for posting the details. The block country outgoing works quite well, but the incoming block country needs to use a NAT to a dead end address.

Ian

I'm also interested in a reasonable method to import huge lists of known bad IPs & Networks. We thought about using API to create them but this will probably take hours for huge lists / huge changes.

So I take it this is not possible? To set Sophos to use or refer to a known Abuse list? There are hacker IPs in the US as well as other countries.

Nope. Unfortunately sophos have lack of features including what you wanna :/ maybe they will listen community someday. All is written in "feature requests" :)