IOC Feeds
Feeds entries are time-limited according to the following rules:
- Hashes: maxium age 1 year
- Network IOCs, such as domains, urls and IPs: maximum age 90 days
- Other IOCs, such as filenames and email addresses: maximum age 30 days
They only contain entries with the IDS flag set and a risk level of 0.
Generic Feeds
Generic Feeds contain all IOC types, including domain:port, ip:port, and domain:ip composites.
Should be used for
Custom integrations
Custom integrations
Custom integrations
Domain Feeds
These feeds contain only domains.
Should be used for
Pi-hole, AdGuard, AdGuard Home, eBlocker, uBlock Origin, AdBlock, Adblock Plus, Opera, Vivaldi, Brave, AdNauseam, Little Snitch Mini, TechnitiumDNS
DNSMasq (v2.86 or newer), adblock-lean, Diversion (v5 or newer)
Blocky (older than v0.23), Diversion (older than v5), OpenSnitch, PersonalBlocklist, pfBlockerNG
AdAway, uMatrix, DNS66, GasMask, NetGuard
Hostfile, Linux, Windows
Proxy Auto Configuration
Response Policy Zone, Bind, Knot, PowerDNS, Unbound
Blocky (v0.23 or newer), Nebulo, NetDuma, OPNsense, YogaDNS
DNSCloak, DNSCrypt, TechnitiumDNS, PersonalDNSfilter, InviZible Pro
Product-Specific Feeds
Product-specific feeds contain IOCs relevant to specific cyber-security products.
Checkpoint
Fortinet
Microsoft Defender for Endpoint
Cortex XDR
You can view the list of IOCs here and the list of reports here .