Airgap Deltas&Workarounds.

[xfaith]

Is there a good list of items that are not readily available or might need work-arounds in an Air-Gapped environment? And if folks have done work arounds is there any writeups?

I know rule-sets are addressed in the docs already.

But what are some other common things that might not be obvious that depend on external data for enrichment or something like that.

Off hand I was thinking most action items (VirusTotal/Google) -- The obvious.
GeoIP?

[dougburks]

GeoIP?

The GeoIP database is built in so it doesn't require Internet access.