Alright, fellow network wranglers. I've spent an inordinate amount of time this past month tuning our Firepower's "malware blacklist" category. Out of the box, it's a bit of a blunt instrument, and we were drowning in false positives—mostly from internal dev tools hitting version control hosts and CI/CD platforms that got flagged. It was noisy enough to cause real alert fatigue.
I finally got a handle on it by combining some targeted policy adjustments with a more surgical use of object overrides. The key isn't to disable the category wholesale, but to prune it intelligently. Here's the approach that worked for us.
First, identify the culprits. Go to **Analysis > Connections > Intrusions** and filter for the 'malware blacklist' category. Use a time range like the last 24 hours. Sort by destination address or domain. You'll likely see a pattern—a handful of domains or IPs causing most of the noise. For us, it was things like `raw.githubusercontent.com` and our internal artifact repository.
Once you've got your list, you can create URL or network object overrides. Don't just make a global exception; tie it to the specific access control policy. Here's an example of creating a simple network object for a trusted host and then using it in an override:
```bash
# In FMC's object manager, create a network object
object network TRUSTED-GITHUB
range 192.0.2.10 192.0.2.10
```
Then, in your access control policy, find the rule that's using the malware blacklist category. Add an override for that rule: **'Advanced' > 'Add Override' > 'URL/Object'**. Select your `TRUSTED-GITHUB` object and set the action to "Trust." This tells the system to skip the blacklist check for traffic to that host, but only within that specific rule context.
The second part is to consider splitting the category. In the intrusion policy, you can actually deselect specific intelligence sources within the "malware blacklist" if you find one particular feed is too aggressive. Go to **Policies > Intrusion > Your Policy > Intelligence > Sources**. Drill down into the malware blacklist and review the enabled sources. Sometimes one feed is the main offender.
This two-step process—targeted overrides in the access policy and fine-tuning the intel sources—reduced our false positives by about 80% without noticeably impacting security. It's a bit of a manual process at first, but it's worth the upfront effort. Has anyone else found a different angle on this? I'm curious if there's a more automated way to feed these exceptions back.