MISP feeds to FortiGate

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Hello,

I may found the answer to your question about how to consume IOCs from MISP events in FortiGate:

1. Integrate FortiGate with MISP: Configure the integration between FortiGate and MISP to establish communication and data exchange.
2. Import IOCs: Set up a process to import IOCs from MISP events into FortiGate. This can involve creating custom feeds or utilizing existing threat intelligence feeds within FortiGate.
3. Update Security Policies: Use the imported IOCs to update your security policies in FortiGate. This ensures that your network security measures are aligned with the latest threat intelligence from MISP.
4. Monitor and Respond: Continuously monitor the IOCs from MISP in FortiGate and set up automated responses or alerts to react promptly to any identified threats.

Hi,

were you successful with this? 

No native MISP connector on FortiGate is a pain point a lot of people run into — the External Feed connector approach works but it takes some scripting on the MISP side to expose your IOCs in a format FortiGate can actually consume. If you have FortiSOAR in your stack that integration is much cleaner, but for most shops it's just the external feed workaround. Worth checking the Fortinet docs linked above for the exact feed format requirements.