Feed Ekleme Rehberi Feed Setup Guide

Feed'leri Sisteminize Ekleyin Add Feeds to Your System

SiberKapan tehdit istihbarat feed'lerini FortiGate, pfSense, OPNsense, SIEM ve DNS filtreleme sistemlerinize dakikalar icinde entegre edin. Integrate SiberKapan threat intelligence feeds into your FortiGate, pfSense, OPNsense, SIEM and DNS filtering systems in minutes.

Kullanılabilir Feed'ler Available Feeds

Asagıdaki URL'lerden herhangi birini kopyalayıp cihazınıza yapıstırın. Copy any URL below and paste it into your device.

🛡 IP Address Threat Feeds TXT

FortiGate External Connectors > Threat Feeds > IP Address bolumune ekleyin. Add under FortiGate External Connectors > Threat Feeds > IP Address.

All-in-One https://siberkapan.org/api/v1/view/all-feed

FortiGate https://siberkapan.org/api/v1/view/fortigate-feed

Honeypot https://siberkapan.org/api/v1/view/honeypot-feed

Web Attacker https://siberkapan.org/api/v1/view/nginx-feed

🌐 Domain / URL Threat Feeds TXT JSON

USOM kaynaklı zararlı domain ve URL listesi. FortiGate External Connectors > Threat Feeds > Domain Name bolumune ekleyin. USOM-sourced malicious domain and URL list. Add under FortiGate External Connectors > Threat Feeds > Domain Name.

Tum Domain https://siberkapan.org/domains/txt

Kritik (>=4) https://siberkapan.org/domains/txt?type=domain&min_criticality=4

JSON https://siberkapan.org/domains/json?limit=10000

⚠

FortiGate entry-level cihazlarda (40F/60F) External Connector limiti genellikle 128K-256K kayıttır. Tam liste ~480K kayıt icerdiginden, bu cihazlarda min_criticality=3 veya min_criticality=4 filtresi kullanmanız onerilir. FortiGate entry-level devices (40F/60F) typically have a 128K-256K External Connector limit. Since the full list contains ~480K records, using min_criticality=3 or min_criticality=4 filter is recommended for these devices.

FortiGate Kurulum Adımları FortiGate Setup Steps

Security Fabric > External Connectors sayfasına gidin. Sag ustteki Create New butonuna tıklayın. Navigate to Security Fabric > External Connectors. Click Create New in the top right.

Threat Feeds bolumunde IP listesi icin IP Address, domain listesi icin Domain Name secin. Under Threat Feeds, select IP Address for IP lists or Domain Name for domain lists.

Name alanına feed ismini yazın (orn. SiberKapan-AllFeed). URL alanına yukarıdaki feed URL'ini yapıstırın. Refresh Rate olarak 60 dakika onerilir. Enter a feed name in the Name field (e.g. SiberKapan-AllFeed). Paste the feed URL from above into the URL field. Set Refresh Rate to 60 minutes.

Feed olusturulduktan sonra Policy & Objects > Firewall Policy sayfasında bir DENY kuralı olusturun. Source veya Destination adresine olusturdugunuz feed'i secin. After creating the feed, go to Policy & Objects > Firewall Policy and create a DENY rule. Select your feed as the Source or Destination address.

⌨ FortiGate CLI Alternatifi ⌨ FortiGate CLI Alternative

# IP Address Threat Feed ekle
config system external-resource
  edit "SiberKapan-AllFeed"
    set type address
    set resource "https://siberkapan.org/api/v1/view/all-feed"
    set refresh-rate 60
  next
end

# Domain Name Threat Feed ekle
config system external-resource
  edit "SiberKapan-DomainFeed"
    set type domain
    set resource "https://siberkapan.org/domains/txt?type=domain&min_criticality=4"
    set refresh-rate 60
  next
end

# Deny policy olustur (ornek)
config firewall policy
  edit 0
    set name "Block-SiberKapan"
    set srcintf "any"
    set dstintf "any"
    set srcaddr "all"
    set dstaddr "SiberKapan-AllFeed" "SiberKapan-DomainFeed"
    set action deny
    set schedule "always"
    set service "ALL"
  next
end

Diger Platformlar Other Platforms

pfSense / OPNsense

Firewall > Aliases bolumunden yeni bir URL Table (IPs) alias olusturun ve SiberKapan feed URL'ini yapıstırın. Sonra bu alias'ı firewall kurallarınızda kullanın. Create a new URL Table (IPs) alias under Firewall > Aliases and paste the SiberKapan feed URL. Then use this alias in your firewall rules.

SIEM (Splunk, Wazuh, ELK)

JSON endpoint'ini kullanarak periyodik olarak verileri cekin. Alternatif olarak STIX 2.1 ve TAXII 2.1 protokollerini destekliyoruz. Use the JSON endpoint to periodically pull data. Alternatively, we support STIX 2.1 and TAXII 2.1 protocols.

TAXII 2.1 https://siberkapan.org/taxii/

STIX 2.1 https://siberkapan.org/api/v1/stix

MISP

MISP arayuzunde Sync Actions > Feeds > Add Feed ile ekleyin. SiberKapan MISP varsayılan feed listesindedir. Add via Sync Actions > Feeds > Add Feed in MISP. SiberKapan is in MISP's default feed list.

MISP Feed https://siberkapan.org/misp-feed/manifest.json

DNS Filtreleme (Pi-hole, AdGuard, Unbound)

Domain feed'ini DNS blocklist olarak ekleyin. Pi-hole icin Group Management > Adlists bolumune URL'i yapıstırın. Add the domain feed as a DNS blocklist. For Pi-hole, paste the URL under Group Management > Adlists.

Domain TXT https://siberkapan.org/domains/txt?type=domain