Types and file formats of threat feeds
Each threat feed is a list of threats of one type only. File formats vary by type. Types of threat feed include:
-
URL filter (FortiGuard category) — One URI per line in the file. For example:
https://192.168.1.10/url
https://example.com/url
http://example.com:8080/url
*.example.com/url
Both IDN and UTF-8 encoding is supported. Wildcards (
*) at the start or end are supported. IPv6 URLs must be in[ ]format.Domain name and URI lists from threat feeds share the rating category number range 192 to 221 (a total of 30 categories). See also Configuring custom URL rating categories.
-
IP address — One IPv4 or IPv6 address, IP address range, or subnet per line in the file. For example:
192.168.1.100
172.16.1.2/24
172.16.1.1-172.16.1.100
2001:0db8::eade:27ff:fe04:9a01/120
-
Malware hash — One hash per line in the file. Each line has the format:
<hash> [optional description]
For example:
24cda42b9d3f723b65cb5e38d7ad17cd871132fa
a57983cb39e25ab80d7d3dc05695dd0ee0e49766 Trojan-Ransom.Win32.Virus-Sample.abfl
For best performance, do not mix different types of hexadecimal hashes together in the list. Use either MD5, SHA1, or SHA256. Alternatively, see Configuring file signatures.
Comments are supported. For example:
# Comment about the URI below.
https://example.com/maliciousurl
File size is limited to 10 MB or 131072 entries, whichever limit is reached first. If the number of entries exceeds the limit, FortiMail displays a warning and does not load entries after the limit.
|
|
FortiMail does not detect duplicate entries (both in the same file and in different files), but you can use tools such as the |