ruleset-sources: Require an Auth-Key for ThreatFox downloads
Commit Message
Since 21 October 2026, ThreatFox file exports require an abuse.ch
Auth-Key.
News link:
https://www.linkedin.com/posts/abuse-ch_authenticate-steadyplatform-steadysignal-activity-7518660733203832832-ohAX
IPFire's ThreatFox provider still uses the unauthenticated download URL,
which prevents ruleset updates.
I have tested a two-line change that marks ThreatFox as requiring a
subscription code and uses the authenticated v2 export URL. This reuses
the existing WUI "Subscription Code" field, stored provider settings and
URL substitution.
Fixes bug report: https://bugzilla.ipfire.org/show_bug.cgi?id=14664
Signed-off-by: Adam Gibbons <adam.gibbons@ipfire.org>
---
sid_range => ["91000000", "91999999"],
},
b/config/suricata/ruleset-sources
@@ -143,8 +143,8 @@ our %Providers = (
summary => "ThreatFox Indicators Of Compromise Rules",
website => "https://threatfox.abuse.ch/",
tr_string => "threatfox rules",
- requires_subscription => "False",
- dl_url =>
"https://threatfox.abuse.ch/downloads/threatfox_suricata.rules",
+ requires_subscription => "True",
+ dl_url =>
"https://threatfox-api.abuse.ch/v2/files/exports/<subscription_code>/threatfox_suricata.rules",
dl_type => "plain",