Threat feeds

FortiOS threat feeds are external resources (system::ExternalResources). A push feed receives its entries through the monitor API instead of downloading them. #include <forti_api/threat_feed.hpp>.

Create a push feed

1using namespace fortiapi;2 3auto feed = system::push_threat_feed("blocklist", 200);   // remote category 192-221, type domain4feed.comments = "Managed by forti-api";5system::ExternalResources::add(feed);

FortiOS loads a new feed asynchronously (a few seconds); until then pushes are rejected. system::feed_state(name).loaded tells when it is ready.

Push entries

1system::push_entries("blocklist", {"bad.example", "worse.example"});                      // replace all2system::push_entries("blocklist", {"new.example"}, system::FeedCommand::add);3system::push_entries("blocklist", {"bad.example"}, system::FeedCommand::remove);

FortiOS reports a rejected command inside an otherwise successful reply; push_entries turns it into a fortiapi::ApiError, so a failed push is never silent.

Read them back

1auto state = system::feed_state("blocklist");2// state.loaded, state.file_status ("downloaded" once applied), state.error, state.entries3for (const auto& entry: state.entries) std::cout << entry.entry << (entry.valid ? "" : " (invalid)") << "\n";

Pushed entries become visible a few seconds after the push.

Block the feed's category

Use the feed's category in DNS filter profiles (see DNS filter):

1auto profile = dnsfilter::Profiles::get("home");2dnsfilter::block_category(profile, 200);3dnsfilter::Profiles::update(profile);

Delete a feed

FortiOS refuses to delete a feed whose category a profile still lists. delete_threat_feed first allows the category in the profiles that list it (unless another feed provides the same category), then deletes the feed:

1system::delete_threat_feed("blocklist");