Direct Security Integrations

Setup guides for the firewall or router you run, sized to its limits.

• FG

  FortiGate

  IP and domain threat feeds that FortiOS downloads with basic authentication

  • External connector, no relay
  • Lists sized to FortiOS limits
  • Firewall policies and DNS filter
  • Full list on paid plans
  Blocklists

  6 stepsPaidEvery paid plan
• PA

  Palo Alto Networks

  External Dynamic Lists of malicious IPs and domains, sized to PAN-OS limits

  • Client authentication with a certificate profile
  • 50,000 riskiest critical IPs
  • DNS sinkhole for domains
  • Full list on paid plans
  Blocklists

  6 stepsPaidEvery paid plan
• pf

  pfSense

  IP and domain lists for URL Table aliases and pfBlockerNG, through a relay

  • Relay with a netrc file
  • URL Table alias or pfBlockerNG
  • DNSBL for the domain lists
  • Full list on paid plans
  BlocklistsRelay

  6 stepsPaidEvery paid plan
• OP

  OPNsense

  IP lists as URL Table aliases with Basic authorization, domains through a relay

  • Authorized URL Table alias (25.1+)
  • Certificate check turned on
  • Unbound blocklists via a relay
  • Full list on paid plans
  BlocklistsOptional relay

  7 stepsPaidEvery paid plan
• MT

  MikroTik

  Threat domains as a RouterOS DNS adlist, fetched with your API key

  • RouterOS 7.15 and later
  • Fetch with HTTP Basic
  • Scheduled refresh script
  • Full list on paid plans
  Blocklists

  6 stepsPaidEvery paid plan
• nf

  Linux nftables

  Threat IPs as nftables sets on any Linux host, refreshed by a systemd timer

  • curl with a root-only netrc file
  • IPv4 and IPv6 sets, one transaction
  • Hourly check, lists rebuilt every 12 h
  • Full list on paid plans
  Blocklists

  5 stepsPaidEvery paid plan

Setup guides that block threat domains at the resolver.

• PH

  Pi-hole

  Threat domains as an authenticated Pi-hole adlist

  • Plain or adblock syntax
  • API key in the list address
  • Gravity every 12 hours
  • Full list on paid plans
  BlocklistsOptional relay

  6 stepsPaidEvery paid plan
• AG

  AdGuard Home

  Threat domains as an authenticated AdGuard Home DNS blocklist

  • Adblock syntax, subdomains included
  • API key in the list URL
  • 12-hour update interval
  • Full list on paid plans
  BlocklistsOptional relay

  6 stepsPaidEvery paid plan

Setup guides that match logs and network traffic against isMalicious indicators.

• SP

  Splunk lookups and ES

  Threat lists as Splunk lookups and Enterprise Security sources

  • Lookups rebuilt every 12 hours
  • Enterprise Security threat lists
  • HEC push from the dashboard
  • Full list on paid plans
  BlocklistsPush

  8 stepsPaidEvery paid planPro+Pro and Enterprise
• ES

  Elastic Security

  TAXII 2.1 collections for the Custom Threat Intelligence integration and indicator match rules

  • Custom Threat Intelligence 1.8.2+
  • Indicator match rules
  • Value lists without TAXII
  • TAXII on Pro and Enterprise
  TAXII 2.1BlocklistsPush

  7 stepsPaidEvery paid planPro+Pro and Enterprise
• WZ

  Wazuh

  Threat IPs and domains as Wazuh CDB lists, refreshed by a cron script

  • CDB lists from a cron script
  • IPv6 keys quoted
  • Hot reload from 4.13
  • Full list on paid plans
  Blocklists

  7 stepsPaidEvery paid plan
• SU

  Suricata

  Threat IPs and domains as Suricata datasets, reloaded with the rules

  • Datasets of type ip and string
  • DNS and HTTP host rules
  • Rule reload, no restart
  • Full list on paid plans
  Blocklists

  6 stepsPaidEvery paid plan
• QR

  IBM QRadar

  Threat IPs and domains as QRadar reference sets, refilled through the REST API

  • Reference sets of type IP and ALNIC
  • Asynchronous bulk update
  • Python 3, standard library only
  • Full list on paid plans
  BlocklistsTAXII 2.1

  8 stepsPaidEvery paid planPro+Pro and Enterprise

Install isMalicious where analysts already enrich observables.

• 

  OpenCTI

  Native enrichment connector for the OpenCTI threat intelligence platform

  • IPv4, IPv6, and Domain enrichment
  • Risk score with threat labels
  • Listed on Filigran Hub
  • Docker deployment ready

  Filigran Hub (opens in a new tab)
• 

  Cortex / TheHive

  Official

  Official analyzer for Cortex SOAR and TheHive incident response

  • IP, domain, and FQDN analysis
  • Risk scoring with taxonomies
  • TheHive case enrichment
  • Official Cortex-Analyzers repo

  v3.6.8+View release (opens in a new tab)
• 

  IntelOwl

  Observable analyzer that adds isMalicious scores to IntelOwl playbooks

  • IPv4, IPv6, domain, and URL analysis
  • Drop-in analyzer module
  • Playbook compatible
  • Same /check API as Cortex

  Upstream PR (opens in a new tab)

STIX/TAXII 2.1 collections. Sentinel and MISP consume the feed — they do not need a custom IsMalicious app.

• 

  STIX/TAXII 2.1

  Standard TAXII collections for TIPs, SIEMs, and custom clients

  • Discovery at api.ismalicious.com/taxii2/
  • IPs, domains, URLs, hashes, C2
  • Basic Auth or X-API-KEY
  • Works with any TAXII 2.1 client
• 

  Microsoft Sentinel

  Ingest isMalicious indicators through Sentinel’s built-in TAXII connector

  • Content Hub Threat Intelligence solution
  • TAXII 2.1 API root and collection IDs
  • Score-filter before auto-block
  • Optional Log Analytics destination
• 

  MISP

  Pull TAXII collections into MISP now; native expansion module for live lookups

  • TAXII 2.1 server ingest
  • Expansion and hover module
  • IP, domain, hostname, URL
  • Score, categories, sources

  Upstream PR (opens in a new tab)

Configure from the dashboard. These are outbound destinations, not Splunkbase or Elastic Fleet apps.

• 

  Splunk HEC

  Push IOCs and SOC events to Splunk through HTTP Event Collector

  • Configure in the dashboard
  • IOC sync plus event delivery
  • Pro plan
  • Not a Splunkbase app
• 

  Elastic

  Index IOCs and SOC events with the Elastic Bulk API

  • Configure in the dashboard
  • NDJSON bulk ingest
  • Pro plan
  • Custom index and pipeline
• 

  Sentinel Log Analytics

  Push normalized telemetry to a Log Analytics table for Sentinel hunts

  • Configure in the dashboard
  • Workspace ID and shared key
  • Pro plan
  • Use TAXII for indicator ingest
• 

  Slack

  Post threat, monitor, and CVE alerts to a Slack channel

  • Incoming webhook
  • Event-only (no bulk IOC sync)
  • Paid plans
  • Configure in the dashboard
• 

  Microsoft Teams

  Post SOC alerts as Adaptive Cards to a Teams channel

  • Workflow webhook
  • Event-only (no bulk IOC sync)
  • Paid plans
  • Configure in the dashboard

Lookups in ChatGPT, an n8n community node, and HTTPS webhooks.

• 

  ChatGPT GPT

  Look up IPs, domains, hashes, and emails from ChatGPT without leaving chat

  • Live /check lookups
  • Free API key for IP, domain and hash checks
  • Email & ransomware lookups without a key, 5 per conversation a day
  • Ransomware search
• 

  n8n

  Community node that looks up an IP, domain, or URL from an n8n workflow

  • Check IOC node
  • n8n-nodes-ismalicious
  • No extra runtime deps
  • Same /check API as Cortex
• 

  Webhooks

  Receive eight platform events on an HTTPS endpoint you control

  • threat.detected, monitor.alert, report.created
  • CVE findings, cases, dataset freshness
  • Signed deliveries (whsec_*)
  • Paid plans

How security teams use isMalicious integrations

• SOC Alert Enrichment

  Automatically enrich security alerts with threat context and risk scores for faster triage.

• Automated Threat Hunting

  Integrate threat intelligence into hunting workflows for proactive threat detection.

• Incident Response

  Accelerate investigations with instant IOC enrichment during incident response.

• Custom Integrations

  Build custom integrations using the REST API and the TypeScript SDK.