Threat Feeds: Bring Your Own Intelligence

Business Plus organisations and MSPs can point SafeToOpen at threat feeds they already licence or trust. On the schedule you choose, SafeToOpen downloads each feed, keeps the entries it has not seen before for your organisation, and adds them to your blocked list with the reason you pick. Entries land under Block/Unblock URLs and are blocked immediately in every workspace of the organisation, so one feed covers all your clients.

1. How it works#

1. Console → Configuration → Threat feeds → Add feed. Start from a preset, or describe any address that returns a list.
2. Choose how often to read the feed: every 15 minutes, hourly, every 6 hours, daily or weekly. The first run starts within five minutes of saving; Run now starts it at once.
3. Each run downloads the feed (25 MB limit), parses it, normalises entries (defanged hxxp:// and [.] forms, bare domains, IP addresses), skips everything already blocked for your organisation, and blocks the rest through the same path as a manual block. New entries per run are capped (default 2,000, maximum 5,000); anything beyond the cap follows on the next run.
4. The feed row shows the last run, how many entries were read and how many were new, a status (OK, Partial, Error, Paused) and the message behind it. History lists the last twenty runs.

2. Presets#

Where a vendor publishes several lists, the form shows “Which list from <vendor>” and fills the address, format and a sensible interval for that list. To take more than one list, add the feed once per list.

3. Vendor notes#

abuse.ch (URLhaus, ThreatFox)#

Automated downloads require an Auth-Key. Create a free account at auth.abuse.ch, copy the key, and paste it as the secret; the preset already names the Auth-Key header. Prefer the “online only” or “recent” lists on a short interval; the full database is large and changes slowly, so daily is enough.

OpenPhish and PhishTank#

Both community feeds are public. OpenPhish refreshes every 12 hours, so 6-hourly reads are plenty. PhishTank’s file is tens of megabytes; read it every 6 hours and, if you have an application key, use the keyed address for a higher rate limit.

MISP#

1. Address: your instance’s /attributes/restSearch endpoint. Authentication: API key in a header named Authorization (the preset sets this).
2. Tags: leave blank for all IDS-flagged url, domain and hostname attributes, or list tags to take one feed group, for example a vendor’s feed tag or a TLP level.
3. Look back: 1, 7, 30 or 90 days. The first run pulls that window; later runs only add what is new.

TAXII 2.1 (Anomali, EclecticIQ, OpenCTI, Recorded Future, Cisco, Microsoft Sentinel and others)#

1. Enter the API root, for example https://server/taxii2/api1/, and the username and password or token the vendor issued.
2. Click Discover collections. SafeToOpen asks the server for its collections and lists them with titles and descriptions; collections you cannot read are greyed out.
3. Tick the collections you licence and click Add selected collections. One feed is created per collection, named “<feed> · <collection>”, all sharing the interval, reason and credentials you set.

Recorded Future and Proofpoint ET#

Recorded Future risk lists are CSV; the preset reads the Name column and sends your token in the X-RFToken header. Choose the URL or domain list, or edit the list= parameter for another list from your subscription. Proofpoint ET reputation files are plain text; replace <oinkcode> in the address with your subscription code.

Any other list#

• Plain text: one entry per line; lines starting with # or ; are ignored. Bare domains become https://domain/.
• CSV: give the URL column by header name or 1-based number.
• JSON: give the dotted path to the array (* for the document root) and the field that holds the URL. Common field names are found automatically.
• Authentication: none, an API key in a named header, a bearer token, username and password, or a key in a query parameter. Secrets are stored encrypted and never shown again.

4. Testing before you save#

Test feed downloads and parses the feed with the settings in the form, then shows how many entries it found, the detected format, the size, how many are already blocked, and a sample of twelve entries. Nothing is blocked by a test. If the count is zero, adjust the format, column or path and test again.

5. Pausing and removing#

• Pause stops the schedule and keeps every URL blocked; Resume runs the feed at the next tick.
• Remove asks whether to also unblock the URLs the feed added. Keep them if you are only changing vendors; remove them if the feed was wrong. Manually blocked URLs are never touched.
• Rotating a vendor key: Edit the feed and paste the new secret; leaving the secret blank keeps the stored one.

6. Limits and safeguards#

7. Troubleshooting#