# Q-Feeds, extended reference for LLMs

## About

Q-Feeds is a European cyber threat intelligence provider. The company offers:

1. **Blocklist / feed integrations** for network security appliances and SIEM platforms.
2. **Threat Intelligence Portal (TIP)**, SaaS for analysts with dark web monitoring, IOC lookup, EASM, vulnerability scanning and brand protection.
3. **IOC Lookup API**, REST API for enriching detections in SOC tooling.
4. **TAXII 2.1**, contextual STIX feeds for compatible platforms.

Headquarters: Hilversum, Netherlands (EU-hosted). Serves customers worldwide.

## Pricing (EUR, source of truth)

| Package | Price | Notes |
|---------|-------|-------|
| Community | Free | OSINT, 24h updates, 7-day premium trial |
| Plus | from €99/year | 4h updates, dark web, EASM, weekly vuln scan |
| Premium | from €249/year | 20min updates, DNS data, malicious URL feeds, brand protection, daily vuln scan |
| IOC Lookup API | from €49.99/month | SOC / SIEM enrichment |

Checkout and license activation happen via the TIP account area after purchase.

## Technical integration

- Native plugins or documented setup for major firewalls
- SIEM: threat intel indicators and context via standard import paths
- TIP: web application at tip.qfeeds.com (separate from marketing site)
- Data: 2,500+ intelligence sources, MITRE ATT&CK mapping on IOCs

### Fortinet FortiGate

- Page: https://qfeeds.com/fortinet-fortigate-integration/
- Method: FortiGate External Connectors (external threat feeds) pull Q-Feeds IP, URL and domain blocklists over HTTPS
- Enforcement: firewall policies, web filter and DNS filter
- Updates every 20 minutes; works alongside existing FortiGuard subscriptions
- Free Community edition available for a proof of concept

### MikroTik RouterOS

- Page: https://qfeeds.com/mikrotik-integration/
- Method: two open source RouterOS scripts that fill the `Malware-List` address-list from the Q-Feeds malware IP feed. `Malware Import FULL.rsc` loads the whole list, `Malware Import DIFF.rsc` applies only the changes since your last pull
- Requirements: RouterOS 7.15 or later, admin rights, outbound HTTPS to api.qfeeds.com and a Q-Feeds API token
- Storage: entries are kept in RAM by default (`useDynamic="yes"`) so frequent updates never wear out the router flash
- Schedule: run the full import daily or weekly and match the diff interval to your licence, 1d on Community, 4h on Plus, 20m on Premium
- Safety: the full import keeps the previous entries until the new import succeeds, so a failed download rolls back instead of emptying the list
- Enforcement: you add the firewall filter rules yourself, matching src-address-list and dst-address-list against `Malware-List`
- Scripts: https://github.com/Q-Feeds/Q-Feeds-Integration-for-Mikrotik-RouterOS
- Setup guide: https://qfeeds.com/knowledge-base/mikrotik-setup/

### Wazuh

- Page: https://qfeeds.com/wazuh-integration/
- Method: an open source installer for the Wazuh manager that writes Q-Feeds indicators as CDB lists and adds the decoders and rules that match events against them
- Modes: standard API (malicious IPs and domains, plus malicious URLs on Premium, updated every 20 minutes by cron) or TAXII 2.1 (adds MD5, SHA-1 and SHA-256 file hashes plus threat context, pulled once a day)
- Requirements: Wazuh manager 4.x in /var/ossec, root access, outbound HTTPS to api.qfeeds.com or taxii.qfeeds.com, and an API token or TAXII credentials
- Alerts: rules 100200 and 100201 for IPs, 100210 to 100213 for domains, 100220 for malicious URLs and 100230 to 100232 for hashes, all in the `qfeeds` rule group
- Options: an IP whitelist and Active Response, which blocks a matched address on the local firewall for a timeout you choose
- Installer: https://github.com/Q-Feeds/Q-Feeds-Wazuh-Integration
- Setup guide: https://qfeeds.com/knowledge-base/wazuh-setup/

### OpenCTI, MISP, EclecticIQ, ThreatStream, ThreatConnect

- Pages: https://qfeeds.com/opencti-integration/, https://qfeeds.com/misp-integration/, https://qfeeds.com/eclecticiq-integration/, https://qfeeds.com/anomali-threatstream-integration/, https://qfeeds.com/threatconnect-integration/
- Transport: TAXII 2.1 / STIX 2.1 from taxii.qfeeds.com (Enterprise licence) for OpenCTI, EclecticIQ, ThreatStream and ThreatConnect. REST CSV from api.qfeeds.com is the route for MISP Feeds on any licence, and the fallback for OpenCTI JSON/CSV Feeds on Community, Plus and Premium
- OpenCTI: Data > Ingestion > TAXII Feeds. API root `https://taxii.qfeeds.com/default` (not discovery), collection UUID, Bearer token, dedicated connector user. Setup: https://qfeeds.com/knowledge-base/opencti-setup/
- MISP: Sync Actions > Feeds only. Simple CSV Parsed Feed from api.qfeeds.com, column mapping, Fixed Event, Delta Merge, scheduled fetch task. Works on any licence. Q-Feeds does not offer a TAXII route into MISP. Setup: https://qfeeds.com/knowledge-base/misp-setup/
- EclecticIQ: Incoming feed, TAXII 2.1 poll, STIX 2.1. Discovery `https://taxii.qfeeds.com/taxii2/`, Basic, collection ID. Not inbox. Setup: https://qfeeds.com/knowledge-base/eclecticiq-setup/
- Anomali ThreatStream: TAXII site (discovery, TAXII 2.1, Basic) then a TAXII feed per collection. Setup: https://qfeeds.com/knowledge-base/anomali-threatstream-setup/
- ThreatConnect: TAXII Ingest App from TC Exchange, Feed Deployer, mapping Generic, STIX type Indicator, one deploy per collection. Setup: https://qfeeds.com/knowledge-base/threatconnect-setup/

### TAXII 2.1 feeds and server

- Page: https://qfeeds.com/taxii-feeds-server/
- Standard: TAXII 2.1 and STIX 2.1, both OASIS Standards since June 2021. Q-Feeds implements 2.1 only; TAXII 1.x and 2.0 clients are not supported
- How it works: a client reads the discovery endpoint `/taxii2/`, picks an API root, subscribes to a collection, then polls the collection's objects endpoint for a TAXII envelope of STIX 2.1 objects. Use the `added_after` filter for incremental pulls and `limit`/`next` for pagination
- Authentication: HTTP basic authentication and bearer tokens over TLS, so most SIEM and TIP connectors work without custom code
- Collections: curated categories such as APT infrastructure, botnets, ransomware hashes and malicious URLs, refreshed every 20 minutes
- Self-hosting: Q-Feeds sells its own TAXII 2.1 server software with a management portal and a STIX watch-folder function. It is not open source, but it is specification-compliant, so any conforming client works
- Licensing: TAXII is the Enterprise TAXII package and needs its own licence, separate from Community, Plus and Premium. The free Community edition does not include TAXII access, but it carries the same curated indicators over ordinary feeds if you want to evaluate the intelligence first
- Server documentation: https://taxii.qfeeds.com/docs

## Site structure (marketing)

- `/`, Homepage (English). Includes a free IOC lookup tool: enter any IP, domain, URL or file hash to get an instant Q-Feeds threat verdict (verdict, confidence score, first/last seen, number of reporting sources). A few free lookups per day without an account; enrichments, MITRE ATT&CK links and related indicators unlock with a free Threat Intelligence Portal account.
- `/nl/`, Homepage (Dutch)
- `/de/`, Homepage (German)
- `/fr/`, Homepage (French)
- `/es/`, Homepage (Spanish)
- `/pt/`, Homepage (Portuguese)
- `/pricing/`, Pricing
- `/nl/pricing/`, Pricing (Dutch)
- `/de/pricing/`, Pricing (German)
- `/fr/pricing/`, Pricing (French)
- `/es/pricing/`, Pricing (Spanish)
- `/pt/pricing/`, Pricing (Portuguese)
- `/threat-intelligence-feeds/`, Threat intelligence feeds (pillar): curated IP and domain feeds for firewalls, SIEMs and DNS, plus malicious URL feeds on Premium; free Community tier, Premium refreshes every 20 minutes
- `/fortinet-fortigate-integration/`, Fortinet FortiGate integration
- `/mikrotik-integration/`, MikroTik integration: open source RouterOS scripts that keep a `Malware-List` address-list current from the malware IP feed
- `/wazuh-integration/`, Wazuh integration: open source installer that adds Q-Feeds CDB lists, decoders and rules to a Wazuh manager over the standard API or TAXII 2.1
- `/opencti-integration/`, OpenCTI integration (commercial page): why curated Q-Feeds intelligence belongs in the OpenCTI knowledge graph, native TAXII ingestion with no connector to maintain, licence options. Configuration detail sits on `/knowledge-base/opencti-setup/`
- `/misp-integration/`, MISP integration (commercial page): correlating MISP events against curated lists, importing versus caching for correlation only, works on any licence. Configuration detail sits on `/knowledge-base/misp-setup/`
- `/eclecticiq-integration/`, EclecticIQ integration (commercial page): curated intelligence as a base layer in Intelligence Center, standard incoming TAXII feed, source attribution per workspace. Configuration detail sits on `/knowledge-base/eclecticiq-setup/`
- `/anomali-threatstream-integration/`, Anomali ThreatStream integration (commercial page): Q-Feeds as one more source for ThreatStream to score and deduplicate, observables ready for existing playbooks. Configuration detail sits on `/knowledge-base/anomali-threatstream-setup/`
- `/threatconnect-integration/`, ThreatConnect integration (commercial page): curated indicators as native ThreatConnect types, vendor-supported TAXII app so nothing is built in house, a separate source per collection. Configuration detail sits on `/knowledge-base/threatconnect-setup/`
- `/taxii-feeds-server/`, TAXII 2.1 feeds and server: managed STIX 2.1 collections over the OASIS TAXII 2.1 API, plus self-hostable server software; explains discovery, API roots, collections, filtering and authentication
- `/book-a-demo/`, Book a live 30-minute platform demo tailored to your firewalls, SIEM and compliance questions
- `/our-partners/`, Partner locator: searchable directory and interactive world map of certified Q-Feeds distributors and resellers. Filter by type (distributor/reseller), search by name/city/country, or use "near me" to find the closest partner by geolocation
- `/downloads/`, Downloads & Manuals (free whitepapers, PDF offline copies of integration manuals, media kit, Windows testing tool)
- `/knowledge-base/`, Knowledge base index (full HTML setup guides for portal features and all integrations)
- `/knowledge-base/what-are-threat-intelligence-feeds/`, What are threat intelligence feeds? (concept guide: contents, delivery formats, free versus paid, how to use)
- `/knowledge-base/getting-started/`, Getting started with the portal
- `/knowledge-base/getting-started/q-feeds-licensing-model/`, Licensing model (beneficial users/FTE, license per active device, active-passive HA needs one license and active-active needs two, 1/2/3 year terms)
- `/knowledge-base/using-threat-lookup/`, How to use Threat Lookup
- `/knowledge-base/dark-web-monitoring/`, How to use Dark Web Monitoring
- `/knowledge-base/attack-surface-and-vulnerability-scanner/`, Attack Surface & Vulnerability Scanner
- `/knowledge-base/brand-protection/`, How to use Brand Protection
- `/knowledge-base/get-your-threat-feeds/`, Get your threat feeds (API keys)
- `/knowledge-base/ioc-lookup-api-and-taxii/`, IOC Lookup API and TAXII 2.1
- `/knowledge-base/fortinet-fortigate-setup/` and other integration setup guides (Palo Alto, Sophos XGS, OPNsense, pfSense, SonicWall, Check Point, MikroTik RouterOS, Exabeam, Wazuh, OpenCTI, MISP, EclecticIQ, Anomali ThreatStream, ThreatConnect, NFtables/IPtables, Pi-hole/AdGuard/Technitium, Testing Tool)
- `/security-policy/`, Vulnerability disclosure policy (how to report, scope, safe harbor, hall of fame for credited researchers; contact security@qfeeds.com, machine-readable at `/.well-known/security.txt`)
- Future: `/about_qfeeds/`, `/contact/`, `/products/`, `/solutions/`, `/support/`

## Knowledge base

Simple, end-user help articles at https://qfeeds.com/knowledge-base/ (English, Dutch, German, French, Spanish and Portuguese):

- Getting started: create an account, activate the free Community package, navigate the Threat Intelligence Portal
- Licensing model: licenses are sized by beneficial users (FTE), one license per active firewall/device (an active-passive High Availability cluster needs one license, an active-active cluster needs two), and 1, 2 or 3 year terms for Plus and Premium; TAXII is priced separately
- Using the portal: Threat Lookup (look up IPs, domains, URLs, hashes; single and bulk), Dark Web Monitoring (leaked credentials, scheduled checks), Attack Surface & Vulnerability Scanner (scan targets, read findings), Brand Protection (monitor look-alike domains and phishing, request takedowns)
- What are threat intelligence feeds: concept guide covering what feeds contain (malicious IPs, URLs, domains), delivery formats (plain blocklists, firewall-native lists, TAXII/STIX 2.1), free versus paid, and how to enforce them on firewalls, SIEMs and DNS
- Threat feeds: create an API key and copy feed URLs for a firewall or SIEM
- Developer access: IOC Lookup API (https://api.qfeeds.com/openapi/) and TAXII 2.1 server (https://taxii.qfeeds.com/docs), authenticated with your Q-Feeds API key as a Bearer token
- Full integration setup guides (HTML): Fortinet FortiGate, Palo Alto, Sophos XGS, OPNsense, pfSense, SonicWall, Check Point, MikroTik RouterOS, Exabeam, Wazuh, OpenCTI, MISP, EclecticIQ, Anomali ThreatStream, ThreatConnect, Linux NFtables/IPtables, Pi-hole/AdGuard/Technitium DNS, and the Windows Testing Tool. Matching PDF manuals for offline use are on /downloads/ (no PDF manuals for the TI platform guides)
- Linux NFtables/IPtables guide: the installer is open source at https://github.com/Q-Feeds/NFtables-IPtables-integration-script (Apache-2.0). It auto-detects nftables or iptables+ipset, keeps its rules in a dedicated qfeeds table or QFEEDS_INPUT/QFEEDS_OUTPUT chains, supports whitelists and outgoing blocking, and updates via cron with full and diff syncs

## Downloads

All resources are free to download at https://qfeeds.com/downloads/:

- Whitepapers: MSSP, Integrations, Compliancy & Regulations, About us, Supported devices, and a Dutch service description (Dienstbeschrijving)
- Integration manuals: Fortinet FortiGate, Palo Alto, Sophos XGS, OPNsense, pfSense, SonicWall, Exabeam, NFtables/IPtables, Pi-hole/AdGuard/Technitium DNS, plus the Tester Tool manual
- API/TAXII: OpenAPI documentation for the REST API and TAXII 2.1 server
- Media kit: logos and brand assets (ZIP)
- Tools: Q-Feeds Windows testing tool and the Linux NFtables/IPtables install script, which is open source (Apache-2.0) at https://github.com/Q-Feeds/NFtables-IPtables-integration-script
- Open source integrations on GitHub: MikroTik RouterOS scripts at https://github.com/Q-Feeds/Q-Feeds-Integration-for-Mikrotik-RouterOS and the Wazuh installer at https://github.com/Q-Feeds/Q-Feeds-Wazuh-Integration. Both need a valid Q-Feeds token and have no PDF manual, the setup guides live in the knowledge base

## SEO & locale

- Default language: English (`x-default`)
- `hreflang` alternates: `en`, `nl`, `de`, `fr`, `es`, `pt`
- Locale detection: URL prefix > user preference (localStorage) > optional geo/browser auto-detect (admin toggles)
- Currency display: user preference > geo region > EUR default

## Contact

- General: via https://qfeeds.com/contact/
- Demo requests: via https://qfeeds.com/book-a-demo/
- LinkedIn: https://www.linkedin.com/company/q-feeds/
- Phone: +31 (0) 85 00 22 932