Correlation with threat intel data

[samadmemon]

Hi All,

I am trying to build a use-case from the firewall logs wherein if any allowed traffic is observed from any Public IP towards the Network on suspicious ports like SSH, RDP etc , it should trigger an alert. Is there any way through which I can achieve the following through Enterprise security :

1. If there is allowed connection from any other IP other than the IP in threat intel , alert severity should be low.

2. If there is allowed connection from threat intel IP, alert severity should be high.