# Enforcement feeds & integrations

> Push indicators to Palo Alto EDL, Fortinet, Suricata and DNS RPZ, STIX, TAXII and MISP feeds, five SIEMs, Jira and ServiceNow, with sightings back.

Source: https://wahukeza.com/platform/enforcement

Enforce · Feeds & integrations

## In the formats your stack already speaks. And back again.

Seven enforcement formats with ETag polling and a confirmed feed per brand, three standards feeds, five SIEM destinations carrying six event streams, eight alert channels and two ticketing systems, and a sightings API so what the edge actually blocked flows back into confidence.

Blocklist feed

## Seven formats, one endpoint, ETag polling.

Filter by indicator type, confidence floor, ATT&CK technique or tool, feed, brand, or changes since a time; the device polls with If-None-Match and gets a 304 when nothing changed. Usage is metered per key.

| format= | for |
| --- | --- |
| plain | One value per line. Anything that reads a text file. |
| nginx | A deny map for the bundled nginx / OpenResty sidecar. |
| json | Typed entries with technique, tool and tag enrichment. |
| edl | Palo Alto External Dynamic List. |
| fortinet | FortiGate threat feed format. |
| suricata | IP reputation / rules for Suricata. |
| rpz | DNS Response Policy Zone for resolvers. |

GET /api/feeds/blocklist?type=ip&format=edl&minConfidence=70

Standards out

## Interoperate with whatever you keep.

-   GET /api/stix/…
    
    ### STIX 2.1 export
    
    Indicators, SDOs, or whole bundles, with markings.
    
-   /taxii2
    
    ### TAXII 2.1 server
    
    Discovery, a collection registry, feed tiers, the first-party and sector collections.
    
-   GET /api/misp/feed
    
    ### MISP feed
    
    A pullable manifest + events feed any MISP instance can subscribe to.
    
-   CSV / JSON
    
    ### Flat exports
    
    For the spreadsheet, the SOAR, the script.
    

Brand & fraud

## Block what impersonates you, in the same formats.

-   per brand
    
    ### A confirmed feed for each brand
    
    Each protected brand gets its own feed of confirmed impersonation and fraud infrastructure, in the plain, JSON, EDL, Fortinet and RPZ formats and as a TAXII and MISP collection. Candidates never reach it: only items confirmed by corroboration, the page read or an analyst.
    
-   fraud types
    
    ### Context, not enforcement values
    
    IBANs, phone numbers, sender IDs, app packages and social handles travel in the JSON, STIX and MISP outputs for your fraud team. The nginx, Suricata and RPZ formats refuse them, and MISP never marks them for IDS.
    

How brands are watched and lookalikes confirmed is on [Brand & fraud protection](https://wahukeza.com/platform/brand-protection).

Sightings

## What the edge blocked comes back as evidence.

A device that pulls a blocklist also posts what it matched. Sightings re-score recency and confidence, mint first-party relations, and turn a firewall into a sensor. Reference consumers ship in the box: an nginx/OpenResty sidecar and a NanoPi nftables appliance.

[The edge appliances](https://wahukeza.com/platform/sensors#hardware)

Outbound integrations

## Notify, export, ticket. With protected secrets and an approval gate.

Every channel and destination stores its credentials behind a protected-secret seam, runs SSRF and TLP checks per dispatcher, and can be kill-switched per tenant.

SIEM event streams

-   detections
-   alerts
-   honeypot sessions
-   indicator changes
-   audit
-   availability

Six batched, cursor-driven streams in a versioned event envelope, to any of the five destinations. The audit stream carries the hash-chained audit log; the availability stream carries DoS and DDoS events with their all-clear.

### Alert channels

-   Slack
-   Microsoft Teams
-   E-mail
-   Webhook
-   PagerDuty
-   Opsgenie
-   In-app
-   Web Push

Rules by severity, type or tag; one envelope, eight dispatchers; playbooks notify on the same channels. Web Push comes with Mobile Notifications and carries a pointer, never the content.

### SIEM destinations

-   CEF over syslog-TLS
-   Splunk HEC
-   Elastic Bulk
-   Microsoft Sentinel DCR
-   JSON webhook

The six streams above, to whichever destination your SOC already runs.

### Ticketing

-   Jira Cloud
-   ServiceNow

Jira Cloud and ServiceNow. Open tickets from cases or playbooks, and their status is pulled back onto the case; case export attaches the evidence.

Playbooks

## When X, do Y. With a dry run and a rate cap.

-   trigger → conditions → actions
    
    ### The shape
    
    Fire on ingest, a sensor-session alert, a hunt match, a schedule, an endpoint detection or an availability event; match on severity, type, tag, source or TLP; run an action list.
    
-   enrich · tag · add-to-case · open-takedown · notify · call-webhook · open-ticket · endpoint-respond · share-to-group
    
    ### The catalogue
    
    Nine actions over the platform’s own services. No scripts and no arbitrary code. open-takedown only drafts a notice, endpoint-respond only proposes an action, and share-to-group waits for approval.
    
-   dry-run · rate caps · TLP gate · approval
    
    ### The rails
    
    Test-run before enabling; caps per playbook; TLP gate on anything that leaves. Consequential actions wait for an approval with expiry, which can be given from the phone with Mobile Notifications.
    

## Point a firewall at it.

Pull an EDL or an RPZ from a reference deployment, watch a sighting come back, and see confidence move.

[Book a demo](https://wahukeza.com/contact?intent=demo)

[Next: cases, incidents & playbooks](https://wahukeza.com/platform/workflow)