|
| 1 | +--- |
| 2 | +pcx_content_type: concept |
| 3 | +title: Custom Indicator Feeds |
| 4 | +sidebar: |
| 5 | + order: 8 |
| 6 | +--- |
| 7 | + |
| 8 | +import { Render } from "~/components"; |
| 9 | + |
| 10 | +Cloudflare's threat intelligence team crowdsources attack trends and protects users automatically, such as from zero-day vulnerabilities like the [HTTP/2 Rapid Reset attack](https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/). However, in some cases, Cloudflare will partner with external entities that have their own feeds which can be shared with eligible Cloudflare users. |
| 11 | + |
| 12 | +With Custom Indicator Feeds, Cloudflare provides a threat intelligence feed based on data received from various Cyber Defense Collaboration groups. The security filtering capabilities are available to eligible public and private sector organizations. |
| 13 | + |
| 14 | +## Publicly available feeds |
| 15 | + |
| 16 | +Cloudflare provides some feeds to Gateway users without the need to establish a provider relationship. |
| 17 | + |
| 18 | +| Name | Description | Availability | |
| 19 | +| ----------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | |
| 20 | +| [Treasury Early Indicator Feed](https://www.cloudflare.com/press-releases/2024/us-department-of-treasury-pnnl-finserv-threat-intel-feed/) | Threat data for financial institutions provided by the US Department of Treasury and Pacific Northwest National Laboratory (PNNL). For more information, contact your account team. | Approved financial services organizations | |
| 21 | +| [UK NCSC Public Threat Indicators](https://www.ncsc.gov.uk/information/pdns) | Recursive DNS service supplied by the UK National Cyber Security Centre (NCSC) to block DNS-based malware. | All users | |
| 22 | + |
| 23 | +## Get started |
| 24 | + |
| 25 | +<Render file="indicator-feeds-overview" /> |
| 26 | + |
| 27 | +If your organization is interested in becoming a provider or a subscriber, contact your account team. |
| 28 | + |
| 29 | +### Create a Custom Indicator Feed |
| 30 | + |
| 31 | +Providers can create and manage a Custom Indicator Feed with the [Indicator API endpoints](/api/operations/custom-indicator-feeds-get-indicator-feeds): |
| 32 | + |
| 33 | +1. Create a feed with the [Create new indicator feed endpoint](/api/operations/custom-indicator-feeds-create-indicator-feeds). Feeds are lists of indicators. |
| 34 | +2. Upload data to the feed with the [Update indicator feed data endpoint](/api/operations/custom-indicator-feeds-update-indicator-feed-data). Uploaded indicator data must be in a [`.stix2`](https://oasis-open.github.io/cti-documentation/stix/intro) formatted file. |
| 35 | + :::note |
| 36 | + Indicator feeds use a snapshot system. To update feeds with new data, providers must upload a file containing all previous and new indicators. |
| 37 | + ::: |
| 38 | +3. Grant access to subscribers with the [Grant permission to indicator feed endpoint](/api/operations/custom-indicator-feeds-add-permission). Any administrator of the account that owns the feed must add subscribers' `account_tag`s to the feed's allowed subscribers list. |
| 39 | + |
| 40 | +### Use a feed in Gateway |
| 41 | + |
| 42 | +Once an account is granted access to a feed, it will be available to match traffic as a [selector in Gateway DNS policies](/cloudflare-one/policies/gateway/dns-policies/#indicator-feeds). |
| 43 | + |
| 44 | +1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall Policies**. Select **DNS**. |
| 45 | +2. To create a new DNS policy, select **Add a policy**. |
| 46 | +3. Name your policy. |
| 47 | +4. In **Traffic**, add a condition with the **Indicator Feeds** selector. If your account has been granted access to a Custom Indicator Feed, Gateway will list the feed in **Value**. For example, you can block sites that appear in a feed: |
| 48 | + |
| 49 | + | Selector | Operator | Value | Action | |
| 50 | + | --------------- | -------- | ------------------- | ------ | |
| 51 | + | Indicator Feeds | in | _Threat Intel Feed_ | Block | |
| 52 | + |
| 53 | +5. Select **Create policy**. |
| 54 | + |
| 55 | +For more information on creating Gateway policies, refer to [DNS policies](/cloudflare-one/policies/gateway/dns-policies/). |
0 commit comments