system threat-feed
Use this command to configure threat feeds.
Threat feeds are plain text files that contain a list of security threats. Threat feeds can be hosted on FortiClient EMS, third party servers, or your own HTTP/HTTPS web server. In this way, FortiMail units can utilize security information from many vendors, security communities, and specialist teams in your own organization. Once FortiMail is connected to threat feeds, you can select them when you configure security features such as antivirus file signatures and antispam IP reputation and URL filters.
FortiMail periodically synchronizes with threat feeds and automatically imports changes.
|
If the threat feed's web server becomes unreachable and there is a connection status error, then the FortiMail continues to use its existing local cache of the threat feed, regardless of reboot. To get threat feed updates, you must re-establish network connectivity. |
Syntax
config system threat-feed
edit <profile_name>
[set comment<comment_str>]
set type {ip-address | malware-hash | url-category}
set server-identity-check {basic | full | none}
[set update-method {pull}]
set update-interval <minutes_int>
next
end
|
Variable |
Description |
Default |
||
|
Enter the name of the profile. |
|
|||
| Optional description of the local category. |
|
|||
|
If the server requires authentication, enter the password that FortiMail will use to connect. |
|
|||
|
Enter the URI of the threat feed. FortiMail also supports OASIS STIX/TAXII format. To use the TAXII protocol, use the |
|
|||
|
Select the level of server certificate validation strictness, either:
|
none |
|||
|
Enable or disable the threat feed. |
enable |
|||
|
Select the type of threat feed, either:
For details on the types and their required file format, see the FortiMail Administration Guide. |
ip-address |
|||
|
Enter the frequency in minutes of synchronization with the threat feed. Default value is 30 minutes. Valid range is from 1 to 43200 minutes (30 days). |
30 |
|||
|
Currently, only the pull method of threat feed synchronization is supported. |
pull |
|||
|
If the server requires authentication, enter the username that FortiMail will use to connect. |
|