I'm looking at using Threat Lists to manage local lists of known malicious websites that I see traffic to. However, from the documentation, it seems that the threat lists are only able to work with IP addresses, not domains.
Is there anyway to get Threat Lists to work with domains rather than IPs?
If not, what would be the best way to approach this?
Create a threatlist definition.
description = "Threatlist:Malware domains"
fields = domain,description,category,risk
skipheaderlines = 1
type = "Threatlist:Malware"
url = "lookup://<lookupname>"
weight = 90
Make sure that the data source you want this threat list to match has the DEST field populated with a domain value.