Implementing blocklists in the Sekoia SOC platform

This article explains how to implement automated blocklists in the Sekoia SOC platform by using IoC Collections (STIX-formatted indicators with validity and revocation), the platform's SOAR automations to push indicators to third-party solutions (firewalls, EDR, SWG), and methods to retrieve collections for native firewall features. It covers recommended practices for collection organization, handling expiration/removal of indicators, and leveraging built-in retro-hunt and playbook templates to streamline dissemination and maintenance of blocklists.