Fortinet FortiGate threat feeds
Add curated IP, URL and domain threat feeds to your Fortinet FortiGate using native External Connectors. Indicators refresh every 20 minutes on Premium and are enforced straight from your firewall, DNS and web filter policies. Start free, no extra appliance needed. For step-by-step FortiGate configuration, see our knowledge base setup guide.
- 2,500+Intelligence sources
- 20 minFastest update interval (Premium)
- 4 stepsTo full integration
- 3Feed types: IP, URL, DNS
What is the Q-Feeds and FortiGate integration?
The Q-Feeds integration connects curated cyber threat intelligence directly to your Fortinet FortiGate firewall using native External Connectors (external threat feeds). FortiGate periodically fetches Q-Feeds blocklists of malicious IP addresses, domains and URLs over HTTPS and enforces them in your firewall, DNS and web filter policies.
The result is automated, always-current protection: known-bad indicators are blocked at the network edge before they reach your users or servers, with no manual list management. It runs alongside your existing FortiGuard subscriptions to add independent, multi-source intelligence.
Whether you run a single FortiGate or a large Security Fabric, the integration scales from a free proof of concept to full production use.
External threat feeds you can add to FortiGate
IP address threat feed
Add an IP address threat feed to block inbound and outbound traffic to known-malicious hosts, botnets and command-and-control servers in your firewall policies.
URL threat feed
Use a URL threat feed in the FortiGate web filter to stop access to phishing pages, malware downloads and other harmful links.
Domain and DNS threat feed
Feed malicious domains into the FortiGate DNS filter to block command-and-control and phishing domains at resolution time.
Curated categories
Choose focused feeds for phishing, botnets, malware, mobile and dark web threats, so you only enforce what is relevant to your organisation.
Why add Q-Feeds to your FortiGate
-
Fewer false positives
Indicators are cross-referenced across commercial, OSINT and governmental sources and curated to cut noise, so you block real threats, not legitimate traffic.
-
Refreshed every 20 minutes on Premium
Feeds update every 20 minutes on Premium, so your FortiGate stays ahead of fast-moving campaigns automatically.
-
Multi-source resilience
Combining many independent sources removes single-vendor blind spots and hardens your coverage.
-
Faster incident response
Blocking at the edge means faster, more precise response and less time spent on internal investigations.
The Multi-Eyed Principle
The Multi-Eyed Principle emphasises using multiple sources of threat intelligence to strengthen the security and effectiveness of your existing firewall. By combining diverse feeds you achieve a more comprehensive, robust defence against cyber threats.
Multiple sources of IOCs
Commercial, OSINT and governmental intelligence combined in one firewall.
Simple 4-step implementation
Implementation is fast and easy with our 4-step manuals, and a proof of concept is completely free.
Integrate Q-Feeds with FortiGate in 4 steps
Create your free account
Sign up on the Q-Feeds Threat Intelligence Portal and copy your personal feed URLs for IP, URL and domain indicators.
Add an External Connector
In FortiOS, open Security Fabric, External Connectors and add a Threat Feed (IP address, domain name or URL) pointing to your Q-Feeds feed URL.
Set the refresh interval
Choose how often FortiGate pulls the feed and confirm the connector shows a healthy status with imported entries.
Enforce in a policy
Reference the external feed in a firewall policy, DNS filter or web filter to start blocking malicious traffic immediately.
Implementation
Implementation is a breeze thanks to our native support for the Fortinet Next Generation Firewall. We've created convenient manuals for every use case, so your firewall can be hardened in no time.
Fortinet setup guideYour own Fortinet connector project?
Want to use Q-Feeds threat intelligence with Fortinet? Sign up for free and see the power of Q-Feeds for yourself.
Get startedPrefer a different platform?
Frequently asked questions about the FortiGate integration
What is a FortiGate External Connector?
A FortiGate External Connector (external threat feed) lets FortiOS automatically download a list of malicious IPs, domains or URLs from an external source like Q-Feeds and use it in your security policies.
Which threat feeds can I add to FortiGate?
With Q-Feeds you can add IP address feeds, URL feeds and domain (DNS) feeds, and enforce them in firewall policies, the web filter and the DNS filter.
How often are the Q-Feeds threat feeds updated?
The feeds are refreshed every 20 minutes on Premium, so your FortiGate always enforces current intelligence without manual updates.
Do I need a specific FortiOS version?
External threat feeds are supported on current FortiGate firewalls running FortiOS. Our manuals cover the exact steps for your version.
Are there free threat feeds for FortiGate?
Yes. The Q-Feeds Community edition gives you free FortiGate threat feeds, so you can run the integration at no cost and move to Plus or Premium when you want faster updates and commercial sources.
Does it work alongside FortiGuard?
Yes. Q-Feeds adds independent, multi-source intelligence on top of your existing FortiGuard subscriptions for broader coverage.
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Activate free access