Fortigate support for STIX/TAXII

[SmackIT]

Hello experts,

Does Fortigate support STIX/TAXII for receiving / pulling threat intelligence? 

If yes, what versions of STIX/TAXII are supported? 

Thanks. 

[SmackIT]

Hi experts,

Can anyone help respond to this. 

Thanks. 

[bommi]

Hi,

there is no support for STIX / TAXII in fortigate firewalls.

Only the FortiSandbox supports STIX and TAXII.

Best Regards

bommi

[SmackIT]

Thank you for the answer. 

Is STIX/TAXII support by any chance in roadmap in order to pull threat intelligence from other sandboxes? 

[bommi]

Hi SmackIT,

the feature is called "Fabric Connectors":

https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-security-fabric/Connectors/configuri...

You need the "Fabric Connector for threat feeds" part of this documentation.

In FortiOS 6.0 only IP- and Domainlists are supported, in FortiOS 6.2 which is currently beta you can also import Hashlists.

Best Regards

bommi

[bommi]

Hi,

I don't know.

Fortigate firewalls can pull threat intelligence information from webservers.

You can import lists of IP-Addresses, Domains and Filehashes and use this information in the webfilter, dnsfilter and av-filter.

Regards bommi

[SmackIT]

Hi Bommi,

Can you please point me to the related document / KB for doing this? 

Thanks. 

[bommi]

Hi,

this feature is called "Fabric Connector":

https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-security-fabric/Connectors/configuri...

You need the "Fabric Connector for threat feeds" part of this documentation.

In FortiOS 6.0 only IP- and Domainlists are supported, in FortiOS 6.2 which is currently Beta you can also import Hashlists.

Best Regards

bommi

[SmackIT]

Thanks Bommi. 

[awalker]

I think they do now - https://docs.fortinet.com/document/fortigate/7.0.0/new-features/400345/stix-format-for-external-thre...