External Dynamic Lists
Bring Tier4Security threat intelligence directly into your firewall.
Public HTTPS feeds built from our collected indicators of compromise. Each file contains one indicator per line, with no account, API key, or interactive sign-in required.
Score ≥ 80/100 · Activity within 30 days · Refresh your firewall every 5 minutes
Checking feed availability…
Connect your firewall
- Choose a feed that matches the firewall object type. Keep IP, domain, and URL lists separate.
- Paste its HTTPS URL into the external list or threat-feed connector. Leave authentication disabled and enable TLS certificate verification.
- Set a five-minute refresh interval and test retrieval. Confirm the imported entry count and your appliance’s capacity.
- Attach the list to the appropriate security, DNS, or web-filtering policy. Review matches before enabling blocking, and maintain your own exceptions.
Palo Alto Networks
Create an External Dynamic List under Objects. Select IP List, Domain List, or URL List. For URL lists, use the PAN-OS format when available. Configure the certificate profile and reference the EDL in the appropriate policy or profile. EDL setup documentation
Fortinet FortiGate
Create an external threat-feed connector with the matching IP Address, Domain Name, or FortiGuard Category type. Use the standard URLs feed for category feeds. Apply the connector to the relevant firewall, DNS, or web-filter policy. Threat-feed documentation
What the feeds include
Entries are selected by indicator type, score, and last observed activity, then validated, normalized, and deduplicated. Private and reserved IP ranges, special-use domains, public suffixes, malformed values, credentials in URLs, and hashes are excluded. URL indicators are never expanded into whole-domain blocks. No IP ranges or wildcards are generated.
Feeds regenerate on request at most every five minutes, with up to one additional minute of HTTP caching. During a source outage, the last successful snapshot may be served for up to one hour from generation; otherwise retrieval returns HTTP 503. Feeds with no qualifying indicators are not published and return HTTP 404. Lists are never silently truncated. Each feed supports up to 100,000 entries and 10 MB; firewall limits vary by model and software version.
Threat intelligence can include false positives. A score is an assessment signal, not a guarantee that an indicator should be blocked in every environment. Machine-readable feed status