Creating threat feed connectors
You can create threat feed connectors for FortiGuard categories, firewall IP addresses, domain names, and malware hashes.
To create threat feed connectors:
- Go to Fabric View > Fabric > External Connectors, and click Create New. The Create New Fabric Connector wizard is displayed.
- Under Threat Feeds, select FortiGuard Category, IP Address, Domain Name, or Malware Hash, and click Next.
- Configure the following options, and then click OK:
Name
Type a name for the fabric connector object.
URI of external resource
Type the link to an external text file. The path must start with
http://,https://, orfmg://, for example,http://example.com/url.HTTP Basic Authentication
Toggle On to enable basic HTTP authentication, and type a username and password.
Toggle Off to disable basic HTTP authentication.
Category ID
Type the category ID. The ID is between 192 and 221.
Available only when Type displays Domain List.
Refresh Rate
The time in minutes to refresh the external resource.
Comments
(Optional) Type comments about the connector.
Status
Toggle On to enable the fabric connector object. Toggle OFF to disable the fabric connector object.
Update Method
Select the update method:
- External Feed: The threat feed will periodically fetch entries from the URI using HTTP or HTTPS.
- Push API: The threat feed receives entry updates from webhook requests to the FortiGate REST API.