Firewall protection with managed detection and response integration

A threat management computer system configured to monitor a monitored network system, comprising:

• one or more processors;
• one or more computer readable storage media;
• and
• computer readable code stored collectively in the one or more computer readable storage media, with the computer readable code including data and instructions to cause the one or more computer processors to perform a method for responding to a threat comprising:
• storing, by the threat management computer system, indicators of compromise known to the threat management computer system to an indicator of compromise database of the threat management computer system;
• adding third party indicators of compromise to the indicator of compromise database of the threat management computer system;
• governing automatic threat response of a firewall of the monitored network system using the indicator of compromise database of the threat management computer system;
• and
• automatically responding, by the firewall of the monitored network system, to threats associated with the third-party indicators of compromise.

A computer program product comprising:

• one or more computer readable storage media having computer readable program code collectively stored on the one or more computer readable storage media, the computer readable program code being executed by one or more processors of a threat management computer system to cause the threat management computer system to perform a method for responding to a threat comprising:
• storing, by the threat management computer system, indicators of compromise directly known to the threat management computer system to an indicator of compromise database of the threat management computer system;
• adding third party indicators of compromise to the indicator of compromise database of the threat management computer system;
• and
• governing automatic threat response of a firewall of the monitored network system using the indicator of compromise database of the threat management computer system such that the firewall of the monitored network system is capable of automatically responding to threats associated with the third party indicators of compromise.

A method for responding to a threat comprising:

• providing a threat management facility system configured to monitor a monitored network system;
• storing, by the threat management computer system, indicators of compromise directly known to the threat management facility system to hash table library hosted by the threat management computer system in operable communication with the managed or extended detection and response system;
• adding third party indicators of compromise to the indicator of compromise database of the threat management computer system;
• governing automatic threat response of a firewall of the monitored network system using the indicator of compromise database of the threat management computer system;
• automatically performing, by the firewall, a third-party lookup with the indicator of compromise database based on an internet protocol (IP) address type indicator, a domain type indicator and/or URL type indicator against a web traffic payload, a DNS payload and/or a source or destination IP address;
• determining, by the firewall of the monitored network system, a malicious host associated with the third-party indicator of compromise;
• determining, by the firewall of the monitored network system, a policy action when the third-party lookup is positive;
• and
• logging the event in an event log system or dropping the traffic and logging the event in the event log system based on the determining.