Creating threat feed connectors

You can create threat feed connectors for FortiGuard categories, firewall IP addresses, domain names, and malware hashes.

To create threat feed connectors:

1. Go to Fabric View > External Connectors, and click Create New. The Create New Fabric Connector wizard is displayed.

2. Under Threat Feeds, select FortiGuard Category, IP Address, Domain Name, or Malware Hash, and click Next.

3. Configure the following options, and then click OK:

   Name	Type a name for the fabric connector object.
   URI of external resource	Type the link to an external text file. The path must start with http://, https://, or fmg://, for example, http://example.com/url. When using FortiManager hosted resources (fmg://) you must configure the resource file as FortiManager external resource first. See External resources.
   HTTP Basic Authentication	Toggle On to enable basic HTTP authentication, and type a username and password. Toggle Off to disable basic HTTP authentication.
   Category ID	Type the category ID. The ID is between 192 and 221. Available only when Type displays Domain List.
   Refresh Rate	The time in minutes to refresh the external resource.
   Comments	(Optional) Type comments about the connector.
   Status	Toggle On to enable the fabric connector object. Toggle OFF to disable the fabric connector object.
   Update Method	Select the update method: External Feed: The threat feed will periodically fetch entries from the URI using HTTP or HTTPS. Push API: The threat feed receives entry updates from webhook requests to the FortiGate REST API.