Technical Tip: Types of External Threat Feed and their locations in the GUI

hrahuman_FTNT · ‎03-01-2022

Description

This article describes the types of External Threat Feed and their locations in the GUI.

Scope

FortiGate.

Solution

There are 5 types of External Threat Feed.

FortiGuard Category.
IP Address.
Domain Name.
Malware Hash.
Mac address (7.4.0 onwards).

CLI commands to view the type of the External Threat Feed:

config system external-resource

edit "test-ip"

set type address<----- This IP address will be in the DNS profile under the external-ip-blocklist. This can also be used under IPv4 policies as Source/Destination.

set resource "http://1.1.1.1"

set type domain <----- This category will be in the DNS filter profile only.

set category 192

set resource "http://2.2.2.2"

set type category

set category 193 <----- This category will be in the Web-filter profile only.

set resource "http://3.3.3.3"

set type malware <----- This Hash list will be in the antivirus profile.

set resource "http://4.4.4.4"

From 7.4.0 onwards, a 5th category has been introduced under the name 'mac address'.

edit "mac address"

set type mac-address <----- This can be used as a source in firewall policies, proxy policies, and ZTNA rules. For policies in transparent mode or the Firewall Virtual Wire Pair Policy, the MAC Address Threat Feed can be used as a source or destination address.

set resource "http://5.5.5.5"

FortiGuard Category.

IP Address.

Domain Name.

Malware Hash.

The resource will automatically be used for Virus Outbreak Prevention on AntiVirus profiles where the 'External Malware Block List' is enabled.