Juniper ATP Cloud Adaptive Threat Profiling allows SRX Series Firewalls to generate, propagate, and consume threat feeds based on their own advanced detection and policy-match events. This feature allows you to configure security or IDP policies that, when matched, inject the source IP address, destination IP address, source identity, or destination identity into a threat feed, which can be leveraged by other devices as a dynamic-address-group (DAG).

Further details in the below link.

https://www.juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-admin-guide/topics/concept/atp-cloud-adaptive-threat-profiling-overview.html

Adaptive Threat Profiling feeds not being displayed even though it is configured correctly under the IDP rule.

set security idp idp-policy Recommended rulebase-ips rule TEST match from-zone any

set security idp idp-policy Recommended rulebase-ips rule TEST match source-address any

set security idp idp-policy Recommended rulebase-ips rule TEST match to-zone any

set security idp idp-policy Recommended rulebase-ips rule TEST match destination-address any

set security idp idp-policy Recommended rulebase-ips rule TEST then action Recommended

set security idp idp-policy Recommended rulebase-ips rule TEST then application-services security-intelligence add-attacker-ip-to-feed IDP-Feed

root> show services security-intelligence sec-profiling-feed status

Category name :SecProfiling

Feed name : IDP-Feed

Feed type :IP

Last post time :N/A

Last post status code:N/A

Last post status :N/A

Even though the IDP hits have been configured to be added to the Security-Intelligence feeds, they will not be displayed until the feed name being referenced is used as an address object in the security policy. It can be used either as a source-address object or a destination-address object.

Example:

set security policies from-zone A to-zone B policy AB match source-address IDP-Feed

set security policies from-zone A to-zone B policy AB match destination-address any

set security policies from-zone A to-zone B policy AB match application any

set security policies from-zone A to-zone B policy AB then permit application-services idp-policy Recommended

set security policies from-zone A to-zone B policy AB then permit application-services security-intelligence-policy secintel_policy

set security policies from-zone A to-zone B policy AB then permit application-services advanced-anti-malware-policy aamw-policy