Enforce · Feeds & integrations
In the formats your stack already speaks. And back again.
Seven enforcement formats with ETag polling and a confirmed feed per brand, three standards feeds, five SIEM destinations carrying six event streams, eight alert channels and two ticketing systems, and a sightings API so what the edge actually blocked flows back into confidence.
Blocklist feed
Seven formats, one endpoint, ETag polling.
Filter by indicator type, confidence floor, ATT&CK technique or tool, feed, brand, or changes since a time; the device polls with If-None-Match and gets a 304 when nothing changed. Usage is metered per key.
| format= | for |
|---|---|
| plain | One value per line. Anything that reads a text file. |
| nginx | A deny map for the bundled nginx / OpenResty sidecar. |
| json | Typed entries with technique, tool and tag enrichment. |
| edl | Palo Alto External Dynamic List. |
| fortinet | FortiGate threat feed format. |
| suricata | IP reputation / rules for Suricata. |
| rpz | DNS Response Policy Zone for resolvers. |
GET /api/feeds/blocklist?type=ip&format=edl&minConfidence=70
Standards out
Interoperate with whatever you keep.
GET /api/stix/…
STIX 2.1 export
Indicators, SDOs, or whole bundles, with markings.
/taxii2
TAXII 2.1 server
Discovery, a collection registry, feed tiers, the first-party and sector collections.
GET /api/misp/feed
MISP feed
A pullable manifest + events feed any MISP instance can subscribe to.
CSV / JSON
Flat exports
For the spreadsheet, the SOAR, the script.
Brand & fraud
Block what impersonates you, in the same formats.
per brand
A confirmed feed for each brand
Each protected brand gets its own feed of confirmed impersonation and fraud infrastructure, in the plain, JSON, EDL, Fortinet and RPZ formats and as a TAXII and MISP collection. Candidates never reach it: only items confirmed by corroboration, the page read or an analyst.
fraud types
Context, not enforcement values
IBANs, phone numbers, sender IDs, app packages and social handles travel in the JSON, STIX and MISP outputs for your fraud team. The nginx, Suricata and RPZ formats refuse them, and MISP never marks them for IDS.
How brands are watched and lookalikes confirmed is on Brand & fraud protection.
Sightings
What the edge blocked comes back as evidence.
A device that pulls a blocklist also posts what it matched. Sightings re-score recency and confidence, mint first-party relations, and turn a firewall into a sensor. Reference consumers ship in the box: an nginx/OpenResty sidecar and a NanoPi nftables appliance.
Outbound integrations
Notify, export, ticket. With protected secrets and an approval gate.
Every channel and destination stores its credentials behind a protected-secret seam, runs SSRF and TLP checks per dispatcher, and can be kill-switched per tenant.
SIEM event streams
- detections
- alerts
- honeypot sessions
- indicator changes
- audit
- availability
Six batched, cursor-driven streams in a versioned event envelope, to any of the five destinations. The audit stream carries the hash-chained audit log; the availability stream carries DoS and DDoS events with their all-clear.
Alert channels
- Slack
- Microsoft Teams
- Webhook
- PagerDuty
- Opsgenie
- In-app
- Web Push
Rules by severity, type or tag; one envelope, eight dispatchers; playbooks notify on the same channels. Web Push comes with Mobile Notifications and carries a pointer, never the content.
SIEM destinations
- CEF over syslog-TLS
- Splunk HEC
- Elastic Bulk
- Microsoft Sentinel DCR
- JSON webhook
The six streams above, to whichever destination your SOC already runs.
Ticketing
- Jira Cloud
- ServiceNow
Jira Cloud and ServiceNow. Open tickets from cases or playbooks, and their status is pulled back onto the case; case export attaches the evidence.
Playbooks
When X, do Y. With a dry run and a rate cap.
trigger → conditions → actions
The shape
Fire on ingest, a sensor-session alert, a hunt match, a schedule, an endpoint detection or an availability event; match on severity, type, tag, source or TLP; run an action list.
enrich · tag · add-to-case · open-takedown · notify · call-webhook · open-ticket · endpoint-respond · share-to-group
The catalogue
Nine actions over the platform’s own services. No scripts and no arbitrary code. open-takedown only drafts a notice, endpoint-respond only proposes an action, and share-to-group waits for approval.
dry-run · rate caps · TLP gate · approval
The rails
Test-run before enabling; caps per playbook; TLP gate on anything that leaves. Consequential actions wait for an approval with expiry, which can be given from the phone with Mobile Notifications.
Point a firewall at it.
Pull an EDL or an RPZ from a reference deployment, watch a sighting come back, and see confidence move.