Step 1: Create an API key
- Log in to the Threat Intelligence Portal.
- Go to Manage API Keys from the dashboard.
- Select Create Free API Key and copy the token that appears. Keep it private: anyone with the key can pull your feeds.
Step 2: Build your feed URL
A feed URL points your device at one of our lists and includes your API key. It looks like this:
https://api.qfeeds.com/api?feed_type=malware_ip&api_token=YOUR_TOKEN&limit=130000
Replace YOUR_TOKEN with your own key and pick the feed you need:
feed_type=malware_ip: malicious IP addresses.feed_type=malware_domains: malicious domains.feed_type=phishing_urls: phishing URLs.
Two optional settings help you fit the feed to your device:
limit=caps how many indicators are downloaded. Many firewalls have a maximum list size, so setting a limit avoids overloading them.type=csvreturns the list as CSV instead of plain text. Some tools, such as Exabeam, expect CSV.
Most integrations authenticate with HTTP Basic auth: use api_token as the username and your key as the password. If a device does not support that, you can add &api_token=YOUR_TOKEN to the URL instead.
How often feeds update
How fresh your feed is depends on your license: Community refreshes every 24 hours, Plus every 4 hours and Premium every 20 minutes. There is no benefit to polling more often than your license updates.
What next
With your key and feed URLs ready, follow the setup guide for your device.