Connect Q-Feeds to Fortinet FortiGate

Available indicator lists

Q-Feeds provides regularly updated IoC lists you can import into FortiGate:

• Malware IPs (feed_type=malware_ip): dangerous IP addresses
• Malware domains (feed_type=malware_domains): malicious domains
• Phishing URLs (feed_type=phishing_urls): phishing URLs

Example feed URL shape:

https://api.qfeeds.com/api?feed_type=malware_ip&api_token=YOUR_TOKEN&limit=130000

You can verify a feed with HTTP Basic auth (username api_token, password = your API key):

curl -v -u api_token:YOUR_TOKEN "https://api.qfeeds.com/api?feed_type=malware_ip&limit=130000"

Add an External Connector

From FortiOS 6.0, FortiGate can pull IoCs from HTTP/HTTPS text files. After import you can use them in Web Filtering, DNS Filtering, antivirus profiles, and as source or destination in IPv4 and proxy policies.

1. Go to Security Fabric > External Connectors and select Create New.
2. Choose the connector type that matches the feed:
   • IP Address for the malware IP feed
   • Domain Name for domain and URL feeds
3. Set Name to something clear, for example Q-Feeds Malicious IPs.
4. In URI of External Resource, paste your feed URL from the portal.
5. Add &limit=130000 to the URL. FortiGate allows about 10 MB or 131,072 IoCs per dynamic list; without a limit the full feed may exceed appliance capacity.
6. Enable HTTP Basic authentication. Username is api_token; password is your Q-Feeds API key. If Basic auth fails on your firmware, append &api_token=YOUR_TOKEN to the URL instead.
7. Set Refresh Rate to match your license update interval (20 minutes for Premium; longer for Plus / Community).
8. Optionally add comments, switch Status on, and select OK.

Verify the feed downloaded

Select the connector and choose View content to confirm indicators were downloaded. FortiGate automatically splits IP feeds into separate IPv4 and IPv6 lists.

Use the lists in policies

Once imported, apply the connector in Web Filtering, DNS Filtering, firewall rules, antivirus profiles, or as source/destination in IPv4 and proxy policies. Apply them wherever you want blocking to take effect. Repeat the connector setup for each feed type you need (IPs, domains, phishing URLs).

Download the PDF manual