Threat intelligence integrations for firewalls, SIEMs and TI platforms
Q-Feeds delivers the same scored indicators to the security tools you already run. Pick your firewall, SIEM or threat intelligence platform below, or read how delivery works first.
- 2,500+Intelligence sources
- 20 minFastest update interval (Premium)
- 5 minTo full integration
- 100%Made in Europe
One intelligence set, four ways to receive it
Every Q-Feeds indicator is scored, mapped to MITRE ATT&CK and checked against known false positives before it leaves our platform. Integrations only differ in how your tool picks that set up.
Firewalls import plain lists of malicious IPs, domains and URLs through their native mechanism: FortiGate External Connectors, Palo Alto External Dynamic Lists, Sophos threat feeds, OPNsense aliases, pfBlockerNG, Check Point Custom Intelligence Feeds, RouterOS address-lists and UniFi Network Lists.
SIEMs correlate the indicators with your logs. Splunk and Microsoft Sentinel use their threat intelligence frameworks, Wazuh gets an open source installer, and any other SIEM can read the lists or subscribe over TAXII.
TI platforms such as OpenCTI, MISP, EclecticIQ, Anomali ThreatStream and ThreatConnect subscribe to our TAXII 2.1 server and receive STIX 2.1 objects with the full context. For your own tooling there is the IOC Lookup API.
Block known-bad traffic at the edge
Your firewall pulls the Q-Feeds lists on a schedule and enforces them in firewall, web and DNS policies. No agent, no appliance, and the lists refresh themselves.
Fortinet
Add IP, URL and domain threat feeds to your FortiGate with native External Connectors.
Palo Alto
Palo Alto firewalls can be hardened with our threat intelligence.
Sophos XGS
Enhance the Sophos XGS firewall with our threat intelligence.
OPNsense
Enhance OPNsense with our intelligence using the native plugin.
pfSense
Block malicious IPs and domains on pfSense with pfBlockerNG.
Check Point
Feed Q-Feeds intelligence into Check Point with Custom Intelligence Feeds.
MikroTik
Load malicious IPs into a RouterOS address-list with our open source scripts.
UniFi
Block malicious IPv4 and IPv6 addresses with UniFi Network Lists, no scripts needed.
Other firewalls
Bring Q-Feeds intelligence to virtually any firewall.
Correlate your logs with curated indicators
A SIEM only detects what it knows about. Q-Feeds adds scored IPs, domains, URLs and hashes to the correlation layer, so real incidents surface and low-quality alerts do not.
Splunk
Without the right threat intelligence, Splunk is just a log server.
Microsoft Sentinel
One of the most used SIEMs, enriched with the right intelligence.
Wazuh
Detect malicious IPs, domains and hashes in Wazuh with our open source installer.
Other SIEMs
Many SIEM vendors support 3rd party threat intelligence.
Add Q-Feeds as a source in your TI platform
Subscribe to our TAXII 2.1 collections and your platform receives STIX 2.1 indicators with score, ATT&CK techniques, actor and malware relations. MISP and OpenCTI can also schedule the REST lists directly.
OpenCTI
Fill your OpenCTI knowledge graph with curated indicators.
MISP
Correlate your MISP events against curated threat feeds.
EclecticIQ
Curated intelligence in Intelligence Center over TAXII.
Anomali ThreatStream
One more source for ThreatStream to score and dedupe.
ThreatConnect
Curated indicators for your ThreatConnect workflows.
TAXII Feeds & Server
TAXII/STIX 2.1 standard, feeds and server software available.
Frequently asked questions about Q-Feeds integrations
Which firewalls does Q-Feeds integrate with?
Fortinet FortiGate, Palo Alto Networks, Sophos XGS, OPNsense, pfSense, Check Point, MikroTik RouterOS and UniFi Network have documented integrations. Any firewall that can import an external IP or domain list, or speak TAXII, works as well.
Which SIEMs does Q-Feeds integrate with?
Splunk and Splunk Enterprise Security, Microsoft Sentinel and Wazuh have dedicated guides. Exabeam, Taegis XDR and other SIEMs that accept third-party threat intelligence can read the lists or subscribe over TAXII 2.1.
Which threat intelligence platforms are supported?
OpenCTI, MISP, EclecticIQ Intelligence Center, Anomali ThreatStream and ThreatConnect. Each connects to the Q-Feeds TAXII 2.1 server with its built-in TAXII client; MISP and OpenCTI can also pull the REST lists on a schedule.
In which formats is the intelligence delivered?
As plain text lists of IPs, domains and URLs, as firewall-native formats, as STIX 2.1 objects over TAXII 2.1, and through the REST IOC Lookup API. All formats carry the same scored indicator set.
Can I test an integration for free?
Yes. The free Community edition includes the feed URLs and a 7-day Premium trial, so you can connect your firewall, SIEM or TI platform and see live indicators before buying a licence.
Evaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Start free