ThreatGate Remote Feeds

Remote feeds in ThreatGate obtain their content from arbitrary URLs and alternate services. These URLs can be public lists or lists managed internally by administrators. So long as ThreatGate can download the content of the URL, it will attempt to read its contents into a feed. The URL may contain network prefixes, domain names, rexdns expressions, or even mixed content.

Enable Remote

Whether this remote feed is enabled.

Name

The name of the remote feed. Subject to firewall alias name format and restrictions.

Mode

Controls how ThreatGate acts on the content of the feed. See ThreatGate Overview for more detail.

Always Block

For feeds containing network prefixes, ThreatGate inserts firewall rules to block all traffic in any direction going to or from addresses on these lists. For feeds containing domain names or expressions, ThreatGate inserts Blocklists into all CoreDNS groups to block resolution of those entries.

Managed Alias

Creates a firewall alias using any network addresses in the list and a CoreDNS Blocklist for domains and expressions in the list. Administrators can then use the resulting firewall alias in manual firewall rules or use the CoreDNS Blocklist in CoreDNS Groups.

URL

The URL ThreatGate will query to obtain remote feed content.

Suppress Domains

A manual list of domain names and expressions to exclude from remote feed content. This can be used to override remote feeds which include domains that local clients should be allowed to reach.

Suppress CIDRs

A manual list of CIDR networks to exclude from remote feed content.

Headers

Pairs of HTTP Header and Value content that ThreatGate will send when requesting the remote feed URL. These can be useful for obtaining feeds from sources which require basic HTTP authorization or a similar API key mechanism.

Note

If feeds are public, these can typically be skipped.

Header

An HTTP header name.

Value

The value to associate with the HTTP header.