From IOC Lists to Firewall Blocks: Building a Threat Feed Pipeline Without a Paid Subscription — Part 2

pratik.dabhi.4u@gmail.com (Pratik) — Sat, 08 Aug 2026 00:00:00 +0530

The first post ended with a blind spot.

Pramaan, an Argusoft SaaS application, was publishing the feed. Sophos was consuming it. The firewall was dropping known-bad traffic on the paths where threat-feed evaluation actually applied.

DNAT on Pratik’s Localhost

From IOC Lists to Firewall Blocks: Building a Threat Feed Pipeline Without a Paid Subscription — Part 2