STIX format for external threat feeds

The FortiGate's external threat feeds support feeds that are in the STIX/TAXII format. Use the stix:// prefix in the URI to denote the protocol.

All external threat feeds support the STIX format. In this example, a FortiGuard Category threat feed in the STIX format is configured.

To configure a FortiGuard Category threat feed in the STIX format in the GUI:

1. Go to Security Fabric > External Connectors and click Create New.

2. Select FortiGuard Category from the Threat Feeds section.

3. Configure the connector:

   • Name: category-taxii

   • Update method: External Feed

   • URI of external resource: stix://limo.anomali.com/api/v1/taxii2/feeds/collections/200/objects/

   • HTTP basic authentication: Enable and enter the username and password, such as guest and guest.

   

4. Click OK.

5. Edit the connector, and click View Entries in the right side bar to view the retrieved entries.

   

To configure a FortiGuard Category threat feed in the STIX format in the CLI:

config system external-resource
    edit "category-taxii"
        set category 194
        set username "guest"
        set password guest
        set resource "stix://limo.anomali.com/api/v1/taxii2/feeds/collections/200/objects/"
        set server-identity-check {none| basic | full}
        set update-method feed
    next
end

To improve the security of the connection, it is recommended to enable server certificate validation (server-identity-check) either in basic or full mode. By default, server-identity-check is set to none.

If the connector is used in webfilter that blocks category 194, the traffic that matches the retrieved URLs, such as rsiuk.co.uk, is blocked:

1: date=2021-10-06 time=18:07:46 eventtime=1633568867163763708 tz="-0700" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="vd1" policyid=1 sessionid=174974 srcip=10.1.100.12 srcport=48284 srcintf="port2" srcintfrole="undefined" srcuuid="c6753ba2-231b-51ec-1675-090f2b5f1384" dstip=78.129.255.151 dstport=443 dstintf="port1" dstintfrole="undefined" dstuuid="c6753ba2-231b-51ec-1675-090f2b5f1384" proto=6 service="HTTPS" hostname="rsiuk.co.uk" profile="test" action="blocked" reqtype="direct" url="https://rsiuk.co.uk/" sentbyte=75 rcvdbyte=0 direction="outgoing" msg="URL belongs to a denied category in policy" method="domain" cat=194 catdesc="category-taxii"