Firewall integrations

Connect Q-Feeds to Check Point

This setup guide covers Check Point configuration step by step, not the product overview. Add Q-Feeds threat intelligence to your Check Point Security Gateway as a Custom Intelligence Feed so the firewall automatically blocks known malicious IP addresses and domains. Custom Intelligence Feeds are supported from R80.20 onwards and are enforced by the Anti-Bot and Anti-Virus Software Blades.

Before you start, create your API key and feed URLs in the portal. See Get your threat feeds. Match the retrieval interval to your license: Community every 24 hours, Plus every 4 hours, Premium every 20 minutes. Polling faster than your license updates does not improve coverage and needlessly loads the API.

Available indicator lists

Q-Feeds provides regularly updated IoC lists you can import into Check Point:

  • Malware IPs (feed_type=malware_ip): dangerous IP addresses
  • Malware domains (feed_type=malware_domains): malicious domains

Use type=text so the feed is one indicator per line with no header row. This is the cleanest format for Check Point, because every line is a single value the gateway maps straight to column 1.

Example feed URL shape for the IP list:

https://api.qfeeds.com/api.php?feed_type=malware_ip&type=text&ipv6=0&download=0&api_token=YOUR_TOKEN

And for the domain list:

https://api.qfeeds.com/api.php?feed_type=malware_domains&type=text&download=0&api_token=YOUR_TOKEN

You can verify a feed with HTTP Basic auth (username api_token, password = your API key):

curl -v -u api_token:YOUR_TOKEN "https://api.qfeeds.com/api.php?feed_type=malware_ip&type=text&ipv6=0&download=0"

Before you begin

  • A Security Gateway running R80.20 or later, managed from SmartConsole.
  • The Anti-Bot and/or Anti-Virus blade enabled on the gateway. Custom Intelligence Feeds are enforced by these blades.
  • The gateway must be able to reach https://api.qfeeds.com outbound over HTTPS (directly or through your proxy).

You can add the feed with the SmartConsole wizard (Option A) or from the gateway command line (Option B). Pick whichever fits your workflow. The result is the same.

Option A: Add the feed in SmartConsole

  1. In SmartConsole, go to Security Policies > Threat Prevention > Custom Policy > Custom Policy Tools > Indicators.
  2. Click New and select New IoC Feed.
  3. Enter a clear object name, for example Q-Feeds Malicious IPs.
  4. In Action, select Prevent to block matches, or Detect to log only while you test.
  5. In Feed URL, paste your feed URL from the portal (starting with https://).
  6. From the Format drop-down, select Custom CSV, then set Value to column 1 and Type to IP (use Domain for the domain feed). Value and Type are the mandatory fields.
  7. In the Authentication section, enter username api_token and your API key as the password. If you prefer, leave this blank and keep &api_token=YOUR_TOKEN in the URL instead.
  8. Click OK, then repeat for the domain feed (Type Domain).

Set the feed retrieval interval

Check Point uses one global interval for all external feeds. Go to Manage & Settings > Blades > Threat Prevention > Advanced Settings > Threat Prevention Engine Settings > External Feed and set Feed retrieving intervals every to match your Q-Feeds license: Community 24:00 (24 hours), Plus 04:00 (4 hours), Premium 00:20 (20 minutes).

Check Point Threat Prevention Engine Settings showing the External Feed retrieval interval field
External Feed retrieval interval in the Threat Prevention Engine Settings.

Option B: Add the feed in CLI

On the Security Gateway, open Expert mode and use the ioc_feeds command. Map the single value column with --format. Value and Type are mandatory.

Malicious IPs:

ioc_feeds add --feed_name Q-Feeds_Malicious_IPs --transport https --resource "https://api.qfeeds.com/api.php?feed_type=malware_ip&type=text&ipv6=0&download=0&api_token=YOUR_TOKEN" --format [type:ip,value:1] --feed_action Prevent

Malicious domains:

ioc_feeds add --feed_name Q-Feeds_Malicious_Domains --transport https --resource "https://api.qfeeds.com/api.php?feed_type=malware_domains&type=text&download=0&api_token=YOUR_TOKEN" --format [type:domain,value:1] --feed_action Prevent

Prefer HTTP Basic auth over a token in the URL? Add --user_name api_token and enter your API key when prompted for the password, then drop &api_token=YOUR_TOKEN from the resource. Use ioc_feeds show to list configured feeds and ioc_feeds delete --feed_name <name> to remove one.

Install policy

After you add the feeds (SmartConsole or CLI), install the Threat Prevention policy on the gateway so the new indicators take effect. From then on the gateway fetches the feeds on the interval you set and enforces them through Anti-Bot and Anti-Virus.

Verify and troubleshoot

Open Logs & Monitor in SmartConsole and filter on the Anti-Bot or Anti-Virus blade to confirm indicators are being matched. On the gateway you can also run ioc_feeds show to check the feed status.

If a feed does not load, you will see a log like External IOC - <feed>: failed_to_fetch_feed. This almost always means the feed URL is wrong, the api_token is missing or invalid, or the gateway cannot reach api.qfeeds.com (check routing, DNS and any proxy). Test the exact URL with the curl command above from the gateway to confirm connectivity and authentication.

Check Point log details showing an External IOC failed_to_fetch_feed error
A failed_to_fetch_feed log entry points to a URL, token or connectivity problem.

Evaluate our intelligence today!

Simplify your security operations, start your free Q-Feeds trial and experience the difference.

Activate free access