Connect Q-Feeds to Sophos XGS

This guide is for administrators who are configuring the integration. It covers the SFOS version and licensing you need, how to add the Q-Feeds threat feed, and how to enforce it in your firewall and web rules.

Available indicator lists

• Malware IP (feed_type=malware_ip): IP address indicators
• Malware domains (feed_type=malware_domains): domain indicators
• Phishing URLs (feed_type=phishing_urls): URL indicators

Example URL:

https://api.qfeeds.com/api?feed_type=malware_ip&api_token=YOUR_TOKEN&limit=80000

Test with:

curl -v -u api_token:YOUR_TOKEN "https://api.qfeeds.com/api?feed_type=malware_ip&limit=80000"

Appliance storage limits on small models

Sophos gives third-party threat feeds a shared storage quota. IP addresses, domains and URLs all draw from the same pool. If one feed fills that pool, the others cannot load. Sophos publishes the limits per model in Storage limit for third-party threat feeds.

For the XGS 87, XGS 88 and XGS 107 class, Sophos lists about 180,000 IPv4 addresses, 98,000 domains or 18,000 URLs when a single indicator type uses the whole quota. URLs use the most space per indicator, so keep the URL limit low when you run all three feeds.

Full Q-Feeds lists are larger than that capacity. Always set &limit= on each feed URL and split the budget. Do not set the IP feed to the model maximum if you also ingest domains and URLs.

When limit truncates a feed, Q-Feeds returns the newest and highest-priority indicators first. A partial ingest still blocks the most relevant threats. You will not get the full list until you use a larger appliance or a platform without the same IoC storage cap.

Starter budget for an XGS 107 that ingests all three feeds (leaves headroom for longer domains and URLs):

https://api.qfeeds.com/api?feed_type=malware_ip&api_token=YOUR_TOKEN&limit=80000
https://api.qfeeds.com/api?feed_type=malware_domains&api_token=YOUR_TOKEN&limit=35000
https://api.qfeeds.com/api?feed_type=phishing_urls&api_token=YOUR_TOKEN&limit=2500

Watch the storage meter on the firewall after the first poll and adjust the three limits if needed.

Add a third-party threat feed

1. Go to Active threat response.
2. Open the Third-party threat feeds tab.
3. Select Add.
4. Set the parameters:
   • Name: for example Q-Feeds Malicious IPs
   • Description: administrative note, for example Q-Feeds threat intelligence feeds
   • Action: Block to stop traffic, or Monitor to log only while you evaluate
   • Position: Top or Bottom if you run multiple feeds
   • Indicator type: match the feed (IP address, Domain or URL)
   • External URL: your Q-Feeds feed URL, including a safe &limit= for the appliance
   • HTTP Basic authentication: enable; username api_token, password = your API key. If Basic auth fails, put api_token in the URL query string instead
   • Polling interval: match your license (do not go below 20 minutes for Premium)
5. Select Test connection. When it succeeds, select Save.

How Sophos uses the feed

After import, threat intelligence is applied firewall-wide in IPS, DNS, web and DPI modules. In the Log viewer, select Active Threat Response to see hits. Hits also appear in the Sophos Central Firewall Management report hub when you use Central.

Sophos Synchronized Security

If you run Sophos Endpoint with Synchronized Security, threat data feeds are also applied on endpoints. That helps reduce lateral movement after an indicator is known at the firewall.

Download the PDF manual