Threat Feed Me v2.7.2

Application allow-lists you can actually point a firewall at, a URL builder so you never type query strings again, and the 2.7.1 security fixes.

Upgrading from 2.7.0? Upgrade now. 2.7.1 (included here) fixed two security holes in application lists: list fetches weren't SSRF-guarded, and supernets overlapping private space passed the allow-list gate.

Highlights

Application catalog

The Applications page now has a built-in catalog of vendor allow-lists, built by the project from each vendor's own published files:

• Microsoft 365 in all four clouds (Worldwide, GCC High, DoD, 21Vianet), per service area, IPs and URLs separately, with Microsoft's Optimize / Allow / Default categories as tabs
• AWS and Azure per service, Google and Google Cloud, GitHub per service, Cloudflare

Each vendor links to its own documentation on what to allow. Every list has an on/off switch: nothing downloads until you switch a list on, and switching it off stops fetching and serving. Lists serve strictly what the vendor publishes: nothing is converted (no domain is ever resolved into IP ranges) or rewritten.

Firewall URL builder

Under every block list and application list: pick your firewall (FortiGate, Palo Alto, Check Point, Cisco FMC, Sophos, pfSense / pfBlockerNG, Pi-hole), adjust the options, and copy the exact URL. It shows how many entries the URL serves and warns when a list is bigger than your firewall holds, or when a max-entries cut would drop entries from an allow-list.

New URL options

• Threat lists (/feeds/...): ?family=4|6 for one IP version. A Sophos feed is /feeds/medium.txt?hosts=1&family=4.
• Application lists (/lists/...): kind=ip|domain|url, family=4|6, hosts=1, wildcards=keep|drop, limit. An unknown option is an error, so a typo can never serve a different list.
• Every .txt URL sends X-Entry-Count, the list's size before ?limit.

Fixes

• Scheduler: application lists refresh on their own thread, so a slow vendor can no longer stall threat-feed refreshes.
• Custom lists: the JSON filter now reads top-level arrays, so Microsoft's endpoints JSON works as a custom list.
• Reserved names: .local, .localhost, .test and similar are refused in application lists.
• Settings changes: editing a list's source, filter or prefix floors refetches it in full.
• Held refreshes: a stale held refresh can no longer roll a list back when approved.
• SSRF refusal message: it no longer names the internal address a hostname resolved to.

Upgrade notes

• The catalog fills in after the project publishes it. If the Applications page says the catalog hasn't been published yet, check back after the next daily catalog build.
• New outbound request: the Applications page fetches the catalog index from the project's GitHub repository (see PRIVACY.md). For air-gapped installs, or to opt out, set app_catalog.enabled: false.
• Reload any open dashboard tab after upgrading.
• Not included yet: per-region cloud lists. Adobe is also missing for now: its endpoints page can't be fetched by automation.

Full diff: v2.7.0...v2.7.2

Threat Feed Me v2.5.4

v2.5.4 "Flytrap"

Bugfix releases on the 2.5 line, since v2.4.13. 2.5.x is production-proven (running on soc-grfna01); main is bugfix-only until the 2.6 decisions in ROADMAP.md ship.

2.5.4 — hostile QA pass

Four parallel testers (refresh chaos, hostile feed input, auth bypass, phone layouts) against isolated database copies. No auth or CSRF bypass found. Fixed:

• 422 responses no longer echo the rejected value (they used to put refused API keys back in the response)
• Feed weight is validated finite and 0-1 on both add paths (inf used to 500 every JSON surface carrying the row)
• API docs routes (/docs, /redoc, /openapi.json) are off by default
• Refresh UI collapsed to one state: mid-run page loads adopt the running refresh, dirty forms/ dialogs skip the post-run reload

2.5.3 — refresh-click lockup fixed

"Hit Refresh, the interface locks up" was the page, not the server. Failed /api/refresh/status polls now retry with backoff, and a page loaded during a run adopts the run. Also: upload_feed parsing and the host-check middleware no longer block the event loop (pinned by thread tests). Note: only tabs loaded from 2.5.3 on are protected, so reload the dashboard after upgrading.

2.5.2 — sign-in guard bypass closed

With no password set, POST /api/host-check accepted any hostname from any request, so a DNS-rebinding page could save its own domain and pass the first-password guard. Hostnames now only change from an IP, localhost, or an already-saved name.

2.5.1 — dashboard polish

No dashboard stall when clicking during a refresh; per-feed refresh timers; sign-in settable from the System page; FortiGate curl User-Agent; polling defaults tuned for openphish_community and dshield_block.

What 2.5 added over 2.4

Codenamed "Flytrap" after the Venus-flytrap site hero:

• TAXII 2.1 server: your served tiers exposed as STIX 2.1 Indicators
• CrowdSec integration: publish tiers to your LAPI, pull its decisions as feeds
• Recurrence predictor (LightGBM): offline training on churn labels with a backtest acceptance gate (AUC 0.82 honest, 0.70 retrain floor)
• Scoring: opt-in current-listing votes with a 3-day vote grace after a feed drops an indicator
• Dashboard: "Slate Pro" redesign, guided first run, ?limit=N and ETags on served feeds, last-polled-by per feed
• Retention default: 14 days (was 7)
• Security hardening from an external review: SSRF checks pinned to the connected address, body caps, Host-header allowlist against DNS rebinding, credential leakage from feed definitions/settings closed, python-multipart bumped for GHSA-v9pg-7xvm-68hf
• MineMeld migration page with honest coverage claims

Upgrade notes

• If you were on 2.4: read https://github.com/alexlinos/threat-feed-me (site) upgrade notes before pulling 2.5
• After upgrading, reload the dashboard (stale tabs keep old polling code)
• The 14-day retention default changes churn history; the churn log is now in its own compact file

Threat Feed Me v2.4.13

Threat Feed Me v2.4.13 is the current release. The image is on Docker Hub as alexlinos/threat-feed-me:2.4.13 and :latest, built multi-arch from this tag by GitHub Actions with an SBOM and SLSA provenance attestation.

docker run -d --name threat-feed-me -p 8080:8080 \
  -v threatfeedme-data:/app/data alexlinos/threat-feed-me:2.4.13

What changed in 2.4.13

• retention.churn_log_exclude caps sightings logging for wholesale-rotating feeds. One feed's list rotation was about 74% of all churn transitions and half of the raw churn positives; excluding it cuts log growth roughly 4x and stops the predictor from learning that rotation means repeat offender. Source state still syncs for excluded feeds, so re-enabling diffs cleanly.

Since the last published release (1.0.0)

Domains, and two indicator kinds that never mix (2.0.0). Domain feeds for the DNS filter beside IP feeds for the packet filter, with separate tier boundaries per kind, a safety floor for OS-update, CDN and mail infrastructure, and a per-kind feed matrix in the dashboard. Reviewed by a four-agent adversarial pass before release: 20 findings fixed, including an IDNA fold that blocked the wrong domain.

UniFi push (2.1 to 2.3). UniFi OS cannot poll a blocklist URL, so the tiers are pushed into gateway firewall groups after every refresh, one list per policy on every firmware, IP and optional domain lists, no CyberSecure license required. Credentials are write-only from the dashboard and read from the data-volume .env.

Scoring that survives its own data (2.4.5 to 2.4.8). The domain witness gate keys on effective votes rather than raw source count. Domain HIGH is provenance-first: named primary curators force HIGH on their own word, and that authority is revoked while a feed is false-positive-degraded. Four more primary sources added directly instead of through aggregators.

Retention, churn log and the predictor gate (2.4.0 to 2.4.9). Indicators age out max_age_days after last sighting. A sightings log records arrivals and departures per feed; the first version recorded presence snapshots and nearly filled a production disk in two days, and 2.4.9 rewrote it to transitions with a self-healing migration. A churn predictor is wired behind a backtest acceptance gate and stays dark by default.

Operations and supply chain (2.4.10 to 2.4.12). A constant-cost /healthz for container and compose healthchecks. python-multipart bumped for its advisory and the Debian base upgraded at build time, which took a Grype scan of the image from 248 findings to 152. SECURITY.md explains how to scan the image yourself and how to read what remains.

Documentation on main since this tag

• PRIVACY.md: what the software stores, sends and logs, and to whom, checked against the code component by component.

Upgrading

Pull the new image and restart. Data lives on the volume and every migration is additive. See the README's Upgrading section for the compose and Synology paths.

Threat Feed Me! 1.0.0

First public release.

On-prem threat intelligence aggregator: fetches 14 free, keyless threat feeds, dedupes and scores every IP into confidence tiers by cross-feed corroboration, and serves the tiers as plain-text URLs your firewall polls (FortiGate, Sophos, SonicWall, Palo Alto, Cisco, Check Point, pfSense, OPNsense).

• Deploys in one command: docker compose up -d
• Web dashboard: manage feeds, upload custom lists, whitelist false positives, force refreshes, set API keys for keyed feeds
• Feed reputation is earned, not assumed: false-positive flags automatically down-weight noisy feeds
• Netblock-aware scoring: IPs inside another feed's CIDR gain corroboration credit
• Hardened: SSRF guard on feed fetches, unconditional CSRF protection, path-traversal-safe uploads

See the README for the 3-step quick start.