Knowledge base: setup guides
Full setup guides for the Threat Intelligence Portal and every supported integration. Pick a topic below to get started; PDF copies are also on Downloads.
The knowledge base collects every Q-Feeds setup guide in one place, from creating your API key and threat feeds to connecting firewalls, SIEMs and DNS resolvers step by step.
Getting started
Create your account and get your first protection running.
What are threat intelligence feeds?
A plain-language guide: what feeds contain, delivery formats, free versus paid, and how to use them.
Getting started with Q-Feeds
Create your account, activate the free Community package and find your way around the portal.
Get your threat feeds
Create an API key and copy your feed URLs to connect a firewall or SIEM.
Using the Testing Tool
Benchmark your current protection and confirm your Q-Feeds setup works.
Q-Feeds licensing model
See how licenses are counted: per firewall, per beneficial user (FTE) and per term.
Using the Threat Intelligence Portal
Get more out of the features included with your license.
Using Threat Lookup
Look up an IP, domain, URL or file hash and understand the result.
Using Dark Web Monitoring
Search for leaked credentials and set up a recurring check for your domains.
Attack Surface & Vulnerability Scanner
Scan what is exposed to the internet and read the findings.
Using Brand Protection
Watch for lookalike domains and phishing, and request a takedown.
Connect your firewall
Bring Q-Feeds threat intelligence to your firewall so it blocks known bad traffic automatically.
Fortinet FortiGate
Full setup guide using External Connectors.
Palo Alto
Full setup guide using External Dynamic Lists.
Sophos XGS
Full setup guide for third-party threat feeds.
OPNsense
Full setup guide for the native Q-Feeds plugin.
pfSense
Full setup guide using pfBlockerNG.
SonicWall
Full setup guide using the Botnet Filter.
Check Point
Full setup guide using Custom Intelligence Feeds.
MikroTik RouterOS
Full setup guide for the address-list import scripts.
Connect your threat intelligence platform
Point OpenCTI, EclecticIQ, ThreatStream or ThreatConnect at Q-Feeds over TAXII 2.1, or schedule the REST lists in MISP and OpenCTI.
OpenCTI
TAXII Feeds: API root, collection UUID, Bearer token, and the CSV mapper fallback.
MISP
Scheduled CSV feeds: column mapping, delta merge and the fetch schedule.
EclecticIQ
Incoming feed, TAXII 2.1 poll: discovery URL, Basic auth, collection ID.
Anomali ThreatStream
TAXII site first, then a TAXII 2.1 feed per collection.
ThreatConnect
TAXII Ingest from TC Exchange, Generic mapping, Indicator only.
SIEM, DNS and Linux
Bring Q-Feeds to your SIEM, DNS filter or Linux hosts.
Developer access
Pull intelligence into your own tools.
Still stuck?
Cannot find your answer here? Our team is happy to help with getting started, licensing and technical questions.
Contact supportOpen the portal
Log in to the Threat Intelligence Portal to manage your account, feeds and security features.
Open the platformEvaluate our intelligence today!
Simplify your security operations, start your free Q-Feeds trial and experience the difference.
Activate free access