Threat feeds help organizations bolster their cybersecurity posture by aggregating, correlating, and analyzing data from multiple sources. They provide actionable intelligence that helps organizations detect and respond to cyber threats before they can cause damage. Implementing threat feeds involves evaluating an organization’s existing security infrastructure, understanding its inherent risks, and ensuring the feeds are compatible with current tools.

The Threat feed API documentation offers a flexible way to integrate threat intelligence into your tool of choice. You can use a fully automated integration that automatically pushes articles from threat feeds to your tool or an interactive integration that adds a layer of manual curation from a team member before the article is pushed to your tool.

Threat Feed API Documentation: Implement Securely

You can create an external feed to import a list of known malicious IP addresses, domains, URLs, and file hashes into FortiOS. The list can be used for enforcing special security requirements, such as blocking access to specific websites, SSL inspection exemptions, or proxy addresses.

An external feed can also be used to send a list of IoCs to an EDR/XDR solution or SIEM. The EDR/XDR solution can then apply matching analytics to detect and react to threats.

To create a new feed, click the vertical ellipsisin the options column on the Playbooks screen (Figure 5) and select Add Service. Then, configure the following settings.