Integrate MN Risk threat feeds with Fortinet FortiGate

This guide covers FortiGate appliances using FortiOS external feeds. Menu names can differ slightly by FortiOS release. The examples follow FortiOS 7.6.

Before you begin

• Back up the FortiGate configuration and use a change window.
• Confirm the FortiGate can resolve feeds.mnrisk.net and connect to it over HTTPS.
• Use the block feeds for enforcement. Keep the detection feeds in monitoring, correlation, and threat-hunting workflows.
• Add and validate one connector at a time. External-feed capacity depends on the FortiGate model, and entries beyond the model limit are not loaded.
• Enable HTTPS server certificate validation for every connector.

Feed mapping

Use a sector feed instead of the global feed

Every sector uses the same file layout as the global collection. For example, a bank can replace the global IPv4 block URL with:

https://feeds.mnrisk.net/sectors/finance/block/ipv4.txt

Repeat that substitution for each feed type you want to enforce. Do not also apply the matching global block feed if the goal is to limit enforcement to sector-attributed indicators, because the global feed is the broader superset.

Browse available sectors and current feed counts.

Create the external connectors

Repeat these steps for each block feed you plan to use:

1. Go to Security Fabric > External Connectors.
2. Select Create New, then choose the external feed type from the table above.
3. Enter a descriptive name such as MNRisk-IPv4-Block.
4. Select External Feed as the update method.
5. Enter the complete HTTPS feed URL.
6. Set the refresh interval to 1440 minutes, which updates the feed once per day.
7. Enable full server certificate validation.
8. Save the connector, reopen it, and use View Entries to confirm that FortiGate loaded the feed.

FortiGuard Category and Domain Name feeds use the shared remote-category ID range 192 through 221. The GUI assigns the category. If you use the CLI, select unused category IDs.

Optional CLI configuration

The following example creates all six block-feed connectors. Change category IDs 192 and 193 if they are already in use.

config system external-resource
    edit "MNRisk-IPv4-Block"
        set status enable
        set type address
        set update-method feed
        set resource "https://feeds.mnrisk.net/global/block/ipv4.txt"
        set server-identity-check full
        set refresh-rate 1440
    next
    edit "MNRisk-IPv4-CIDR-Block"
        set status enable
        set type address
        set update-method feed
        set resource "https://feeds.mnrisk.net/global/block/ipv4-cidr.txt"
        set server-identity-check full
        set refresh-rate 1440
    next
    edit "MNRisk-IPv6-Block"
        set status enable
        set type address
        set update-method feed
        set resource "https://feeds.mnrisk.net/global/block/ipv6.txt"
        set server-identity-check full
        set refresh-rate 1440
    next
    edit "MNRisk-Domain-Block"
        set status enable
        set type domain
        set category 192
        set update-method feed
        set resource "https://feeds.mnrisk.net/global/block/domains.txt"
        set server-identity-check full
        set refresh-rate 1440
    next
    edit "MNRisk-URL-Block"
        set status enable
        set type category
        set category 193
        set update-method feed
        set resource "https://feeds.mnrisk.net/global/block/urls.txt"
        set server-identity-check full
        set refresh-rate 1440
    next
    edit "MNRisk-SHA256-Block"
        set status enable
        set type malware
        set update-method feed
        set resource "https://feeds.mnrisk.net/global/block/sha256.txt"
        set server-identity-check full
        set refresh-rate 1440
    next
end

Apply the IP block feeds

1. Go to Policy & Objects > Firewall Policy.
2. Create dedicated deny policies, or edit policies that are intended to enforce the feeds.
3. For inbound filtering, use the MN Risk IP connectors as source objects where appropriate.
4. For outbound filtering, use the MN Risk IP connectors as destination objects.
5. Place the deny policies above broader allow policies and enable logging.
6. Apply the IPv6 feed to the corresponding IPv6 policy path used by your FortiOS configuration.

Treat the CIDR feed carefully because one entry can cover an entire network. Start with a limited policy scope, review logs, then expand the rollout.

Apply the domain block feed

1. Go to Security Profiles > DNS Filter.
2. Create or edit the DNS Filter profile used by client traffic.
3. Enable FortiGuard Category Based Filter.
4. Find MNRisk-Domain-Block under Remote Categories and set its action to Block.
5. Apply the DNS Filter profile to the required firewall policies and enable logging.

If you import global/detect/domains.txt, create a separate connector and set its remote-category action to Monitor, not Block.

Apply the URL block feed

1. Go to Security Profiles > Web Filter.
2. Create or edit the Web Filter profile used by outbound web traffic.
3. Enable FortiGuard Category Based Filter.
4. Find MNRisk-URL-Block under Remote Categories and set its action to Block.
5. Apply the Web Filter profile to the required firewall policies and enable logging.

Full path matching for HTTPS URLs depends on the SSL inspection applied to the traffic. Review your inspection design if FortiGate loads the feed but does not match path-specific URLs.

Apply the SHA-256 block feed

1. Go to Security Profiles > Antivirus.
2. Create or edit the Antivirus profile used by the relevant firewall policies.
3. Enable Use external malware block list and select MNRisk-SHA256-Block.
4. Do not use Antivirus quick scan mode with the external malware block list.
5. Apply the Antivirus profile to the required policies and enable logging.

The hash feed can only match files that FortiGate is able to inspect. Encrypted traffic may require an appropriate SSL inspection profile.

Validate and monitor

1. Confirm every connector shows a successful update and nonzero entry count.
2. Compare loaded counts with the feed metadata.
3. Review external connector events for total and invalid entry counts.
4. Review Firewall, DNS Filter, Web Filter, and Antivirus logs for the expected action.
5. Do not validate by browsing to a live malicious URL. Use connector status, logs, or a controlled test feed.
6. Monitor false positives during the initial rollout and maintain a documented local exception process.

Fortinet references

• Configuring a threat feed
• External feeds and supported file formats
• IP address threat feed
• Domain name external feed
• FortiGuard category external feed
• Malware hash external feed