Threat feeds
FortiProxy can dynamically import external threat intelligence lists from an HTTP/HTTPS server as plain text files. Once imported, these threat feeds can be used to enforce specific security policies, such as long-term policies to always allow or block access to certain websites, or short-term requirements to dynamically block access to known compromised locations as threat intelligence updates. Threat feeds are regularly synchronized with the external server. Any changes on the remote server will be imported into FortiProxy based on the configured update interval.
|
If the FortiProxy loses connectivity with the external server, the threat feed will continue to function despite the Connection Status error or reboot. However, the threat feed will not be updated and no new entries will be added until the connection is restored. |
FortiProxy supports the following types of threat feeds:
|
FortiGuard Category |
Dynamically imports a text file from an external server, which contains one URL per line. See FortiGuard category threat feed for more information. |
|
IP Address |
Dynamically imports a text file from an external server, which contains one IP/IP range/subnet per line. See IP address threat feed for more information. |
|
Domain Name |
Dynamically imports a text file from an external server, which contains one domain per line. Simple wildcards are supported. See Domain name threat feed for more information. |
|
Malware Hash |
Dynamically imports a text file from an external server, which contains one hash per line (MD5, SHA1, or SHA256) in the format |
|
URL List |
Dynamically imports a text file containing one URL per line, supporting wildcards. See URL list threat feed for details. |
|
|
FortiProxy does not support STIX/TAXII format feeds, MAC address feeds, or EMS-integrated feeds. |
FortiManager can host threat feeds. See External resources in the FortiManager Administration Guide.
External resources file format
All HTTP/HTTPS external resources files must meet the following format requirements:
-
The file is in plain text format with each entry on its own line.
Comments can be added by using the number sign, for example:
# This is a test. -
The file size and the number of entries are subject to device model limitations. See External resource entry limit.
-
The external resources update period can be set to 1 minute, hourly, daily, weekly, or monthly (43200 min, 30 days).
-
The external resources types "FortiGuard Category" and "Domain Name" share the category number range 192 to 221 (total of 30 categories).
-
No duplicate entry validation is performed. Duplicate entries will appear multiple times.
-
If the number of entries exceed the limit, a warning is displayed. Additional entries beyond the threshold will not be loaded.
The following table lists format guidelines specific to each threat feed type:
|
Threat feed type |
Format requirements |
|---|---|
| FortiGuard Category / URL List (type = category) |
|
| IP Address (type = address): |
|
| Domain Name (type = domain) |
|
| Malware Hash (type = malware) | Malware hash signature entries must be separated into each line. Each line can contain one MD5, SHA1, or SHA256 hash, with an optional description separated by spaces. Valid examples:# MD5 Entry with hash description aa67243f746e5d76f68ec809355ec234 md5_sample1 # SHA1 Entry with hash description a57983cb39e25ab80d7d3dc05695dd0ee0e49766 sha1_sample2 # SHA256 Entry with hash description ae9bc0b4c5639d977d720e4271da06b50f7c60d1e2070e9c75cc59ab30e49379 sha256_sample1 # Entry without hash description 0289b0d967cb7b1fb1451339c7b9818a621903090e0020366ab415c549212521 # Invalid entries 7688499dc71b932feb126347289c0b8a_md5_sample2 7614e98badca10b5e2d08f8664c519b7a906fbd5180ea5d04a82fce9796a4b87sha256_sample3 |
External resource entry limit
The number of entries is globally limited to 200,000 and the file size is globally limited to 16 MB for all external resource entries. If Virtual Domains (VDOMs) are enabled, global entries are counted first, followed by VDOM entries in alphabetical order of VDOM names.
When the maximum number of entries is exceeded, the most recently considered entries are truncated unless you manually reorder the entries using the move CLI command. For example:
config system external-resource
move "entry2" before "entry1"
end