Back to home
FortiGate

FortiGate Firewall Integration

Configure the ThreatHive blocklist as an External Connector threat feed in FortiOS.

  1. Create an External Connector for ThreatHive
    1. Log in to the FortiGate GUI.
    2. Navigate to Security Fabric › External Connectors.
    3. Click Create New.
    4. Under Threat Feeds, select IP Address.
    5. Configure the connector:
      • Name: ThreatHive_Blocklist
      • URI of external resource: https://threathive.net/hiveblocklist.txt
      • Authentication: None
      • Refresh Rate: 15 minutes
      • Comments: Malicious IP feed from ThreatHive.net
    6. Click OK to save.
    7. Click View Entries to verify the IPs were imported successfully.
  2. Apply the blocklist in a firewall policy
    1. Navigate to Policy & Objects › IPv4 Policy.
    2. Click Create New.
    3. Configure the policy:
      • Name: Block_ThreatHive_IPs
      • Incoming Interface: your WAN interface
      • Outgoing Interface: your LAN interface
      • Source: ThreatHive_Blocklist
      • Destination: all
      • Action: DENY
      • Log Traffic: All Sessions (recommended)
    4. Click OK to save.
    5. Ensure this deny rule is positioned above broader allow rules in the policy list.
  3. Verify and monitor
    • Return to Security Fabric › External Connectors and confirm the entry count next to ThreatHive_Blocklist is non-zero.
    • Check Log & Report › Forward Traffic and filter by policy name to see blocked connections.
    • The feed refreshes automatically every 15 minutes — no manual action required.
  4. Tips
    • Test in a lab or with logging-only mode before enforcing in production.
    • Combine with other threat feeds for broader coverage.
    • Forward logs to a SIEM for long-term analysis and alerting.