HoneyLabs blocklist as a FortiGate IP address threat feed

FortiOS can import a text file that lists addresses, ranges or subnets from a URL and refresh it on a schedule; Fortinet calls this an IP address threat feed. The HoneyLabs plain-text feed is that file.

These steps follow Fortinet's administration guide for FortiOS 7.4. We have not run them on a FortiGate ourselves, so try the policy on one interface before the rest.

Save a query

Sign in (free) and save the HoneyLabs query you want the feed to track on the feeds page. Any lookup query works: a port, an ASN, a tag, or a boolean combination. The feed returns the source IPs currently matching it, so a tighter query means a tighter blocklist.

# Example saved queries and what they feed you
port:22 AND NOT tag:scanner     # SSH brute-forcers, known researchers removed
tag:scanner                     # every recognized scanner IP
cve:CVE-2024-4577               # IPs probing one specific CVE
asn:14061 AND port:445          # SMB scans out of DigitalOcean

02
Mint a feed token
On the same page, mint a feed URL for the saved query. The token alone authorizes the fetch: no cookies, no headers, safe to paste into an appliance. Give every consumer its own token so you can revoke a leaked URL without breaking the others.
```
# Your feed URL looks like
https://honeylabs.net/feed/<token>        # plain text, one IP per line
https://honeylabs.net/feed/<token>.csv    # ip,first_seen,last_seen,events,asn,country
https://honeylabs.net/feed/<token>.json   # same fields as JSON
```
03
Create the threat feed
In the GUI, go to Security Fabric > External Connectors, choose Create New and, under Threat Feeds, IP Address. Give it a name and the feed URL. The CLI equivalent is below.
```
config system external-resource
    edit "HoneyLabs_Attackers"
        set type address
        set resource "https://honeylabs.net/feed/<token>"
    next
end
```
04
Use it in a policy
A threat feed can be the source or destination of a local-in policy, which covers traffic to the FortiGate itself, and the destination of a firewall policy. In Policy & Objects > Firewall Policy the feed is listed in the address picker under IP ADDRESS FEED. Set the action to deny.
```
config firewall local-in-policy
    edit 0
        set intf "wan1"
        set srcaddr "HoneyLabs_Attackers"
        set dstaddr "all"
        set service "ALL"
        set schedule "always"
        set action deny
    next
end
```

Worth knowing

Fortinet documents a size limit per external resource (10 MB or 128,000 entries before FortiOS 7.4.4). The attacker feed is far below it; a wide saved query may not be.
Source: Fortinet's FortiOS 7.4 administration guide, "IP address threat feed". Menu names differ slightly between FortiOS versions.

The feed comes as a plain list of IPs, as CSV or as JSON. Any token can be revoked without touching the others, and responses are edge-cached for five minutes, so a tight refresh schedule costs nothing. Create yours on the feeds page, or browse the other integrations.

HoneyLabs blocklist as a FortiGate IP address threat feed

Save a query

Mint a feed token

Create the threat feed

Use it in a policy

Worth knowing