Skip to main content
MORAMADAN
Explorer III
September 12, 2024
Solved

Fortinet recommended malicious IPs or URLs, or Malware Hash source

Hello Team,

                 I am paloalto more guy and I used to utilize Paloalto's EDLs, so I wanted to ask about any Dynamic group that contains Malicious IP addresses, URLs, or domain lists that are included in the FortiOS and I can use them in my policies.

If not, what are recommeded other sources "feeds" to add as External groups as feed that I can use for more protection in my policies?

or also any  Malware Hash feeds that are valuable.

TIA                  

AEK
AEKAnswer
SuperUser
September 12, 2024

Hello Ramadan

Go to menu Policy & Objects > Internet Service Database, you find all bad IP address DBs under the "IP Reputation DB" section. You can use them in policy depending on their direction, as source, destination or both.

ISDB_IP_Reputation.png

AEK

10 replies

AEK
SuperUser
AEKAnswer
SuperUser
September 12, 2024

Hello Ramadan

Go to menu Policy & Objects > Internet Service Database, you find all bad IP address DBs under the "IP Reputation DB" section. You can use them in policy depending on their direction, as source, destination or both.

ISDB_IP_Reputation.png

AEK
MORAMADAN
MORAMADANAuthor
Explorer III
September 12, 2024

Thank you, Good information and good groups, Do you recommend Blocking them all?

Surre I will keep monitoring in the beggining.

AEK
SuperUser
SuperUser
September 12, 2024

Yes, I deny them all for outgoing traffic and for incoming traffic as well when I publish some server.

For incoming traffic keep it under monitoring just in case of false positive. You know many dynamic client public IP addresses are marked bad.

AEK
lkumar
Staff
Staff
September 12, 2024

Hello Ramadan,

Please follow the below-attached articles where you can configure the threat feeds and use it in the firewall policy

> https://docs.fortinet.com/document/fortigate/6.2.0/new-features/625349/external-block-list-threat-feed-policy
> https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/9463/threat-feeds

MORAMADAN
MORAMADANAuthor
Explorer III
September 12, 2024

thank you for the info, useful.

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT