Threat Feeds API

The Threat Feeds API provides a plain text feed of IP addresses and IP ranges from block rules (threats). Countries and ASNs are automatically resolved to IP ranges, making it suitable for integration with firewalls, intrusion detection systems, and other security tools.

Base URL

https://api.gen0sec.com

Authentication

The API supports two authentication methods:

Bearer Token Authentication

Authorization: Bearer <your-api-key>

Basic Authentication

Basic Authentication uses HTTP Basic Auth with:

Username: api (literal string)
Password: Your API key

The credentials are base64-encoded in the format api:your-api-key.

Manual Encoding:

# Encode credentials manually
echo -n "api:your-api-key" | base64
# Output: YXBpOnlvdXItYXBpLWtleQ==

Using cURL:

cURL automatically handles Basic Auth encoding when using the -u flag:

curl -u "api:your-api-key" "https://api.gen0sec.com/v1/threat/feeds"

Using Authorization Header:

# Base64 encode: api:your-api-key
Authorization: Basic YXBpOnlvdXItYXBpLWtleQ==

Endpoints

Get Threat Feed

Retrieve a workspace's access rules as an appliance-consumable list.

Endpoint: GET /v1/threat/feeds

Response Format: Plain text (text/plain) by default; text/csv for the Check Point dialect.

The feed includes:

Direct IP addresses from rules (normalized to /32 for IPv4 or /128 for IPv6)
IP ranges resolved from countries
IP ranges resolved from ASNs

Networks are deduplicated, coalesced (adjacent and overlapping prefixes are merged into the smallest equivalent set) and sorted numerically, IPv4 first. Coalescing is lossless: the merged list covers exactly the same addresses.

Query parameters:

Parameter	Values	Default	Description
`format`	`plain`, `cisco`, `checkpoint`, `nftables`	`plain`	Output dialect
`family`	`v4`, `v6`, `both`	`both`	Address family to publish
`action`	`block`, `allow`	`block`	Publish the deny list or the never-block list
`checksum`	`md5`	(unset)	Return the feed's checksum instead of the feed

plain also accepts txt, fortios and fortigate as aliases.

Response Example:

0.0.0/8
0.0.0/8
168.1.0/24
db8::/32

Get a Named Feed

Publish a single access-rules list rather than every rule in the workspace, so one workspace can serve several feeds to different appliances.

Endpoint: GET /v1/threat/feeds/{list}

{list} is the list's UUID or its name. All the query parameters above apply unchanged.

curl -u api:$API_KEY https://api.gen0sec.com/v1/threat/feeds/edge-blocklist
curl -u api:$API_KEY "https://api.gen0sec.com/v1/threat/feeds/edge-blocklist?format=cisco"

A list can store its own defaults (format, family, action, max_entries, confidence, severity), which keeps the appliance URL bare. An explicit query parameter always wins over a stored default.

If a name matches more than one list the request returns 409 rather than guessing; address the list by UUID to disambiguate.

Conditional Requests

Every response carries an ETag and a Last-Modified. Send them back and an unchanged feed costs a single empty round trip instead of a full re-download — which matters when a fleet of appliances polls on a timer.

# First fetch
curl -sD headers.txt -u api:$API_KEY https://api.gen0sec.com/v1/threat/feeds -o feed.txt
ETAG=$(grep -i '^etag:' headers.txt | cut -d' ' -f2 | tr -d '\r')

# Subsequent fetches: 304 Not Modified, empty body
curl -s -o /dev/null -w '%{http_code}\n' \
  -u api:$API_KEY -H "If-None-Match: $ETAG" \
  https://api.gen0sec.com/v1/threat/feeds

If-None-Match takes precedence over If-Modified-Since; if you send both, the entity-tag decides.

Response headers:

Header	Description
`ETag`	Strong validator over the response body. Differs per format, family, action and content encoding.
`Last-Modified`	When the current feed content first appeared
`Cache-Control`	`private, max-age=30, must-revalidate`
`Vary`	`Accept-Encoding, Authorization`
`X-Feed-Entry-Count`	Number of networks in the feed
`X-Feed-Entry-Limit`	The feed's entry cap

Compression

Send Accept-Encoding: gzip to receive a gzip-encoded body. Without the header the response is uncompressed and byte-identical to what a plain client has always received, so existing integrations are unaffected.

Because a compressed body is a distinct representation, it carries its own ETag. Do not compare an entity-tag obtained with gzip against one obtained without it.

Checksum Sidecar

?checksum=md5 returns the MD5 digest of the feed body instead of the feed. This is what Cisco Secure Firewall's optional MD5 URL expects: the appliance fetches the small digest and skips the feed download entirely when it has not changed.

curl -u api:$API_KEY "https://api.gen0sec.com/v1/threat/feeds?checksum=md5"
# 5d41402abc4b2a76b9719d911017c592

The digest is computed over the exact bytes the feed endpoint returns for the same parameters, so keep them consistent between the two URLs — ?format=cisco&checksum=md5 describes ?format=cisco, not the default feed.

Size Limits

A feed is capped at 131,072 entries by default, matching the ceiling FortiOS enforces on external resources. A single country rule can expand well past that: US alone is roughly 420,000 networks before coalescing.

If a feed exceeds its cap the API returns 413 with no feed content, rather than a truncated list. This is deliberate — the appliance keeps the last list it fetched successfully, so enforcement stays complete instead of silently becoming partial.

{
  "success": false,
  "error": "Feed exceeds the maximum number of entries",
  "details": {
    "entries": 421824,
    "limit": 131072,
    "hint": "narrow the rules (a single country rule can expand to hundreds of thousands of networks) or raise the feed's max_entries"
  }
}

X-Feed-Entry-Count and X-Feed-Entry-Limit are set on the 413 as well as on successful responses, so you can monitor headroom before a feed hits the wall. Raise a specific feed's ceiling with max_entries in its list configuration.

Output Formats

`plain` (default)

One network per line. Suitable for FortiGate external resources, Palo Alto DBL/EBL, and anything that expects a bare list.

10.0.0.0/8
192.168.1.0/24

`cisco`

One entry per line with a # comment header. Cisco Secure Firewall ignores comment lines.

# edge-blocklist
# perimeter deny list
# action: block
# family: both
# generated: 2026-09-01T12:00:00Z
# entries: 2
10.0.0.0/8
192.168.1.0/24

`checkpoint`

CSV for the Check Point R81+ Custom Intelligence Feed, with the columns value, type, confidence, severity and no header row. Host routes are emitted as IP; wider networks as an IP Range in first-last form.

203.0.113.7,IP,high,high
10.0.0.0-10.255.255.255,IP Range,low,medium

confidence and severity come from the individual rule's configuration where set, then the feed's configured default, then high. Networks carrying different values are never merged together.

`nftables`

An element list ready to splice into a set definition. IPv4 and IPv6 need separate nftables sets, so pair this with family.

elements = { 10.0.0.0/8, 192.168.1.0/24 }

Errors

Error (400) — unsupported format, family or action, or a malformed request:

{
  "success": false,
  "error": "Unsupported format",
  "details": { "supported": ["plain", "cisco", "checkpoint", "nftables"] }
}

Error (401) — invalid or missing API key:

{
  "success": false,
  "error": "Unauthorized - invalid or missing API key",
  "details": {}
}

Error (404) — no such access-rules list.

Error (409) — the list name matches more than one list; use the UUID.

Error (413) — the feed exceeds its entry limit (see Size Limits).

Error (500):

{
  "success": false,
  "error": "Internal server error",
  "details": {}
}

Features

Automatic Resolution: Countries and ASNs are resolved to IP ranges using MaxMind GeoIP databases
Coalescing: Adjacent and overlapping networks are merged losslessly into the smallest equivalent set
Deduplication: Duplicate addresses and ranges are removed
Sorted Output: Numeric ordering, IPv4 before IPv6, for stable, diffable output
Conditional GET: ETag / Last-Modified support so unchanged feeds cost one empty round trip
Compression: Optional gzip via Accept-Encoding
Checksum Sidecar: ?checksum=md5 for appliances that check a digest before downloading
Multiple Dialects: Plain, Cisco Secure Firewall, Check Point IoC CSV, and nftables
Named Feeds: Publish several independently-configured feeds from one workspace
Allow Feeds: Publish a never-block list with action=allow
Expiry: Rules are filtered on expires_at at query time, so a lapsed rule stops being served immediately
Caching: Responses are cached server-side for 30 seconds
IPv4 and IPv6 Support: Including per-family feeds via family

Interactive Documentation

Interactive API documentation is available at:

https://api.gen0sec.com/docs/feeds/swagger/

Example Usage

cURL with Bearer Token

curl -X GET "https://api.gen0sec.com/v1/threat/feeds" \
  -H "Authorization: Bearer your-api-key" \
  -H "Accept: text/plain"

cURL with Basic Authentication

curl -X GET "https://api.gen0sec.com/v1/threat/feeds" \
  -u "api:your-api-key" \
  -H "Accept: text/plain"

Python

Using Bearer Token:

import requests

url = "https://api.gen0sec.com/v1/threat/feeds"
headers = {
    "Authorization": "Bearer your-api-key",
    "Accept": "text/plain"
}

response = requests.get(url, headers=headers)
if response.status_code == 200:
    # Process the IP list
    ip_list = response.text.strip().split('\n')
    for ip in ip_list:
        print(f"Block IP: {ip}")
else:
    print(f"Error: {response.status_code} - {response.text}")

Using Basic Auth:

import requests
from requests.auth import HTTPBasicAuth

url = "https://api.gen0sec.com/v1/threat/feeds"
response = requests.get(
    url,
    auth=HTTPBasicAuth("api", "your-api-key"),
    headers={"Accept": "text/plain"}
)

if response.status_code == 200:
    ip_list = response.text.strip().split('\n')
    for ip in ip_list:
        print(f"Block IP: {ip}")
else:
    print(f"Error: {response.status_code} - {response.text}")

Using Basic Auth with Manual Encoding:

import requests
import base64

url = "https://api.gen0sec.com/v1/threat/feeds"
api_key = "your-api-key"

# Encode credentials
credentials = f"api:{api_key}"
encoded = base64.b64encode(credentials.encode()).decode()

headers = {
    "Authorization": f"Basic {encoded}",
    "Accept": "text/plain"
}

response = requests.get(url, headers=headers)
if response.status_code == 200:
    ip_list = response.text.strip().split('\n')
    for ip in ip_list:
        print(f"Block IP: {ip}")

Go

Using Bearer Token:

package main

import (
    "bufio"
    "fmt"
    "net/http"
    "strings"
)

func main() {
    url := "https://api.gen0sec.com/v1/threat/feeds"

    req, _ := http.NewRequest("GET", url, nil)
    req.Header.Set("Authorization", "Bearer your-api-key")
    req.Header.Set("Accept", "text/plain")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    scanner := bufio.NewScanner(resp.Body)
    for scanner.Scan() {
        ip := strings.TrimSpace(scanner.Text())
        if ip != "" {
            fmt.Printf("Block IP: %s\n", ip)
        }
    }
}

Using Basic Auth:

package main

import (
    "bufio"
    "encoding/base64"
    "fmt"
    "net/http"
    "strings"
)

func main() {
    url := "https://api.gen0sec.com/v1/threat/feeds"
    apiKey := "your-api-key"

    req, _ := http.NewRequest("GET", url, nil)

    // Encode credentials for Basic Auth
    credentials := fmt.Sprintf("api:%s", apiKey)
    encoded := base64.StdEncoding.EncodeToString([]byte(credentials))
    req.Header.Set("Authorization", fmt.Sprintf("Basic %s", encoded))
    req.Header.Set("Accept", "text/plain")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    scanner := bufio.NewScanner(resp.Body)
    for scanner.Scan() {
        ip := strings.TrimSpace(scanner.Text())
        if ip != "" {
            fmt.Printf("Block IP: %s\n", ip)
        }
    }
}

Bash Script for Firewall Integration

Using Bearer Token:

#!/bin/bash

# Fetch threat feed
THREAT_FEED=$(curl -s -X GET "https://api.gen0sec.com/v1/threat/feeds" \
  -H "Authorization: Bearer your-api-key" \
  -H "Accept: text/plain")

# Process each IP/range
echo "$THREAT_FEED" | while read -r ip_range; do
    if [ -n "$ip_range" ]; then
        # Add to firewall rules (example for iptables)
        # iptables -A INPUT -s "$ip_range" -j DROP
        echo "Blocking: $ip_range"
    fi
done

Using Basic Auth:

#!/bin/bash

API_KEY="your-api-key"

# Fetch threat feed using Basic Auth
THREAT_FEED=$(curl -s -X GET "https://api.gen0sec.com/v1/threat/feeds" \
  -u "api:${API_KEY}" \
  -H "Accept: text/plain")

# Process each IP/range
echo "$THREAT_FEED" | while read -r ip_range; do
    if [ -n "$ip_range" ]; then
        # Add to firewall rules (example for iptables)
        # iptables -A INPUT -s "$ip_range" -j DROP
        echo "Blocking: $ip_range"
    fi
done

Use Cases

Firewall Integration

Use the feed to automatically update firewall rules:

Using Bearer Token:

# Download feed
curl -X GET "https://api.gen0sec.com/v1/threat/feeds" \
  -H "Authorization: Bearer your-api-key" \
  -o /tmp/threat-feeds.txt

# Update firewall rules (example)
while IFS= read -r ip_range; do
    iptables -A INPUT -s "$ip_range" -j DROP
done < /tmp/threat-feeds.txt

Using Basic Auth:

# Download feed using Basic Auth
curl -X GET "https://api.gen0sec.com/v1/threat/feeds" \
  -u "api:your-api-key" \
  -o /tmp/threat-feeds.txt

# Update firewall rules (example)
while IFS= read -r ip_range; do
    iptables -A INPUT -s "$ip_range" -j DROP
done < /tmp/threat-feeds.txt

Intrusion Detection Systems

Import the feed into your IDS/IPS:

Using Bearer Token:

# Download and format for Snort
curl -X GET "https://api.gen0sec.com/v1/threat/feeds" \
  -H "Authorization: Bearer your-api-key" | \
  sed 's/^/var THREAT_IPS [/' | \
  sed 's/$/]/' > /etc/snort/threat-feeds.rules

Using Basic Auth:

# Download and format for Snort using Basic Auth
curl -X GET "https://api.gen0sec.com/v1/threat/feeds" \
  -u "api:your-api-key" | \
  sed 's/^/var THREAT_IPS [/' | \
  sed 's/$/]/' > /etc/snort/threat-feeds.rules

Scheduled Updates

Set up a cron job to regularly update your threat feeds:

# Add to crontab (runs every hour)
0 * * * * /usr/local/bin/update-threat-feeds.sh

Firewall Platform Integration

The Threat Feeds API is designed to integrate seamlessly with major firewall platforms. Below are implementation examples for popular enterprise firewalls.

Palo Alto Networks

Palo Alto Networks firewalls support Dynamic Block Lists (DBL) or External Block Lists (EBL) that can fetch threat feeds from external URLs.

Configuration Steps:

Navigate to Objects > Dynamic Block List
Click Add to create a new block list
Configure the feed:
- Name: Gen0Sec Threat Feed
- Source URL: https://api.gen0sec.com/v1/threat/feeds
- Authentication: Configure Basic Auth with username api and your API key as password

Using Basic Auth:

# Test the feed URL first
curl -u "api:your-api-key" "https://api.gen0sec.com/v1/threat/feeds" -o /tmp/dbl.txt

# Verify the file is accessible
cat /tmp/dbl.txt

PAN-OS Configuration:

Go to Objects > Dynamic Block List
Click Add
Enter the following:
- Name: Gen0Sec-Threat-Feed
- Source URL: https://api.gen0sec.com/v1/threat/feeds
- Source Type: URL
Click Test Source URL to verify connectivity
Configure authentication:
- Authentication Type: Basic
- Username: api
- Password: Your Gen0Sec API key

Apply to Security Policy:

Navigate to Policies > Security
Edit your security policy
Add the Dynamic Block List to the Source or Destination field
Set action to Deny

For more details, see the Palo Alto Networks documentation.

Cisco ASA FirePOWER Services

Cisco FirePOWER supports custom IP reputation feeds that can be configured through ASDM or the FirePOWER Management Center.

Configuration via ASDM:

Navigate to Configuration > ASA FirePOWER Configuration > Object Management > Security Intelligence > Network Lists and Feeds
Click Add Network Lists and Feeds
Configure the feed:
- Name: Gen0Sec Threat Feed
- Type: Select Feed from dropdown
- Feed URL: https://api.gen0sec.com/v1/threat/feeds
- Update Frequency: Set to desired interval (e.g., every 1 minute)
- Authentication: Configure Basic Auth with username api and your API key

Using Basic Auth:

The feed URL should include authentication. You can use Basic Auth:

# Test the feed
curl -u "api:your-api-key" "https://api.gen0sec.com/v1/threat/feeds"

Configure Security Intelligence:

Navigate to Configuration > ASA FirePOWER Configuration > Policies > Access Control Policy
Select the Security Intelligence tab
Move Gen0Sec Threat Feed to the Blacklist column
Enable logging if desired
Click Store ASA FirePOWER Changes

Deploy Policy:

Click Deploy and select Deploy FirePOWER Changes
Monitor deployment status in Monitoring > ASA Firepower Monitoring > Task Status

Manual Feed Upload (Alternative):

If you prefer to upload a file instead:

# Download the feed
curl -u "api:your-api-key" "https://api.gen0sec.com/v1/threat/feeds" -o gen0sec-feeds.txt

# Upload via ASDM:
# 1. Navigate to Object Management > Security Intelligence > Network Lists and Feeds
# 2. Click Add Network Lists and Feeds
# 3. Type: Select "List"
# 4. Upload List: Browse and select gen0sec-feeds.txt

For more details, see the Cisco ASA FirePOWER documentation.

Fortinet FortiGate

FortiGate firewalls support External Block Lists (EBL) that can fetch threat intelligence feeds from external sources.

Configuration via Web UI:

Navigate to Security Fabric > External Connectors > External Block List
Click Create New
Configure the feed:
- Name: Gen0Sec Threat Feed
- Type: IP Address
- Source: URL
- URL: https://api.gen0sec.com/v1/threat/feeds
- Update Frequency: Set desired interval (e.g., 1 minute)

Authentication Configuration:

FortiGate supports HTTP Basic Authentication for external feeds:

In the External Block List configuration, enable Authentication
Authentication Type: Basic
Username: api
Password: Your Gen0Sec API key

CLI Configuration:

config system external-resource
    edit "Gen0Sec-Threat-Feed"
        set type address
        set category 0
        set resource "https://api.gen0sec.com/v1/threat/feeds"
        set username "api"
        set password "your-api-key"
        set update-interval 3600
    next
end

Apply to Firewall Policy:

Navigate to Policy & Objects > Firewall Policy
Edit your firewall policy
In Source or Destination, add the External Block List
Set action to Deny or Block

Verify Feed Status:

# Check feed status
diagnose external-resource list

# Force update
execute external-resource update Gen0Sec-Threat-Feed

For more details, see the Fortinet FortiGate documentation.

Sophos Firewall

Sophos Firewall supports third-party threat feeds that can be integrated into Active Threat Response policies.

Configuration Steps:

Navigate to Threat Protection > Active Threat Response > Configure Feeds
Click Add Feed
Configure the feed:
- Feed Name: Gen0Sec Threat Feed
- Feed Type: IP Address List
- Feed URL: https://api.gen0sec.com/v1/threat/feeds
- Update Frequency: Set to desired interval (e.g., Every 1 minute)

Authentication:

Sophos Firewall supports HTTP Basic Authentication:

In the feed configuration, enable Authentication
Authentication Type: Basic
Username: api
Password: Your Gen0Sec API key

Apply to Active Threat Response Policy:

Navigate to Threat Protection > Active Threat Response > Policies
Create or edit a policy
Add the Gen0Sec Threat Feed to the Blocked IPs section
Configure action (Block, Drop, or Log)

CLI Configuration (Alternative):

# Configure via CLI
system threat-feed add name "Gen0Sec-Threat-Feed" \
    type ip \
    url "https://api.gen0sec.com/v1/threat/feeds" \
    username "api" \
    password "your-api-key" \
    update-interval 3600

Verify Feed:

Navigate to Threat Protection > Active Threat Response > Configure Feeds
Check the feed status and last update time
Click Update Now to manually refresh the feed

For more details, see the Sophos Firewall documentation.

Cisco Secure Firewall

Cisco Secure Firewall (FMC) fetches a network feed over HTTPS and can optionally check an MD5 URL first, downloading the list only when the digest has changed.

Configuration Steps:

Navigate to Objects > Object Management > Security Intelligence > Network Lists and Feeds
Click Add Network Lists and Feeds
Configure the feed:
- Name: Gen0Sec Threat Feed
- Type: Feed
- Feed URL: https://api.gen0sec.com/v1/threat/feeds?format=cisco
- MD5 URL: https://api.gen0sec.com/v1/threat/feeds?format=cisco&checksum=md5
- Update Frequency: 30 minutes
Save and deploy, then add the feed to an Access Control policy's Security Intelligence tab.

Authenticate with Basic auth (api:<your-api-key>).

tip

Keep the query parameters identical between the two URLs. The MD5 describes the feed built with the same parameters, so pointing the digest at ?format=cisco&checksum=md5 while the feed URL omits format would compare against a different representation and defeat the optimisation.

# Verify both URLs before configuring the appliance
curl -u api:$API_KEY "https://api.gen0sec.com/v1/threat/feeds?format=cisco" -o feed.txt
curl -u api:$API_KEY "https://api.gen0sec.com/v1/threat/feeds?format=cisco&checksum=md5"
md5sum feed.txt   # must match

Check Point R81+

Check Point R81 and later support Custom Intelligence Feeds, which ingest indicators from a CSV URL.

Configuration Steps:

In SmartConsole, open Security Policies > Threat Prevention > Custom Policy Tools > Indicators
Add a new Custom Intelligence Feed
Configure the feed:
- Feed URL: https://api.gen0sec.com/v1/threat/feeds?format=checkpoint
- Format: CSV
- Fields: value, type, confidence, severity (in that order, no header row)
- Authentication: Basic, username api, password your API key
Install the Threat Prevention policy

curl -u api:$API_KEY "https://api.gen0sec.com/v1/threat/feeds?format=checkpoint"
# 203.0.113.7,IP,high,high
# 10.0.0.0-10.255.255.255,IP Range,low,medium

Set per-feed confidence and severity defaults in the access-rules list configuration, or override them per rule. Verify the values match what your Check Point version expects before deploying.

General Integration Tips

Feed Format:

The Threat Feeds API returns a plain text list with one IP address or IP range per line:

168.1.0/24
0.0.0/8
db8::/32

Authentication:

All platforms support HTTP Basic Authentication:

Username: api (literal string)
Password: Your Gen0Sec API key

Update Frequency:

Recommended update intervals:

High-security environments: Every 15-30 minutes
Standard environments: Every 1-4 hours
Low-priority feeds: Every 12-24 hours

Testing the Feed:

Before configuring in your firewall, test the feed URL:

# Test with Basic Auth
curl -u "api:your-api-key" "https://api.gen0sec.com/v1/threat/feeds" | head -20

# Verify authentication works
curl -I -u "api:your-api-key" "https://api.gen0sec.com/v1/threat/feeds"

Monitoring:

Monitor feed update status in your firewall's management interface
Set up alerts for feed update failures
Review firewall logs to verify blocks are being applied
Check feed size and update frequency to ensure timely threat protection

Rate Limits

API rate limits apply to prevent abuse. Contact support if you need higher limits.

Caching

Feeds are rebuilt at most once every 30 seconds server-side, and every response carries an ETag and Last-Modified.

Prefer conditional requests over polling faster: sending If-None-Match costs one empty round trip when nothing has changed, whereas polling below the 30-second rebuild interval only re-downloads a body that cannot have changed yet. See Conditional Requests.

Support

For API support, visit:

Discord: https://discord.com/invite/jzsW5Q6s9q
Email: support@gen0sec.com

Base URL​

Authentication​

Bearer Token Authentication​

Basic Authentication​

Endpoints​

Get Threat Feed​

Get a Named Feed​

Conditional Requests​

Compression​

Checksum Sidecar​

Size Limits​

Output Formats​

plain (default)​

cisco​

checkpoint​

nftables​

Errors​

Features​

Interactive Documentation​

Example Usage​

cURL with Bearer Token​

cURL with Basic Authentication​

Python​

Go​

Bash Script for Firewall Integration​

Use Cases​

Firewall Integration​

Intrusion Detection Systems​

Scheduled Updates​

Firewall Platform Integration​

Palo Alto Networks​

Cisco ASA FirePOWER Services​

Fortinet FortiGate​

Sophos Firewall​

Cisco Secure Firewall​

Check Point R81+​

General Integration Tips​

Rate Limits​

Caching​

Support​

Base URL

Authentication

Bearer Token Authentication

Basic Authentication

Endpoints

Get Threat Feed

Get a Named Feed

Conditional Requests

Compression

Checksum Sidecar

Size Limits

Output Formats

`plain` (default)

`cisco`

`checkpoint`

`nftables`

Errors

Features

Interactive Documentation

Example Usage

cURL with Bearer Token

cURL with Basic Authentication

Python

Go

Bash Script for Firewall Integration

Use Cases

Firewall Integration

Intrusion Detection Systems

Scheduled Updates

Firewall Platform Integration

Palo Alto Networks

Cisco ASA FirePOWER Services

Fortinet FortiGate

Sophos Firewall

Cisco Secure Firewall

Check Point R81+

General Integration Tips

Rate Limits

Caching

Support