Messages

That is indeed the intended use of the feature. It will then send you an alert whenever any product name contains "ruckus unleashed".

[What is new]

Hi all,

We are very excited about this release. With the new Q-Feeds Connector, OPNsense is, as far as we know, the first firewall in the world where you can build firewall rules directly on MITRE ATT&CK mapping: block or allow traffic based on the tactics, techniques, software and groups behind an IP address.

The new version is available as a development package of the plugin (os-q-feeds-connector-devel). Before it goes to the production release, we would like as many people as possible to try it on real hardware with real traffic. If you use Q-Feeds today, or want to try it, your feedback is very welcome.

What is new

There is a new Security > Q-Feeds Connect > Firewall Aliases page. You create your own aliases and decide which IP addresses go into them, based on the full MITRE ATT&CK mapping: tactics, techniques, software and groups. Each of these has its own "include" and "exclude" selector, and every entry shows how many IP addresses it currently covers. Every alias you create appears as __qfeeds_<name> and can be used in firewall rules like the existing Q-Feeds aliases. For example, you can block every address linked to a specific threat group or malware family, or only log traffic tied to a certain technique.

The default aliases (such as __qfeeds_malware_ip) are still created, so existing rules keep working.

Please note: for now, the MITRE filters work for IP addresses only.

Coming next

In a future release we will also show the MITRE ATT&CK data on the Events tab, so you can see right away which tactics, techniques, software or groups a blocked connection is linked to. And we will also add this functionality to Unbound and DNScrypt-proxy.

How to get it

There is no need to switch your whole firewall to the development release. You only install the development version of the plugin, from the shell (SSH or console option 8):

• Take a configuration backup first (System > Configuration > Backups). Use a lab or non-critical firewall if you can.
• If you already have the Q-Feeds Connector installed, remove the current version first. Your settings and API key are kept:
  
  Code Select Expand
  pkg remove os-q-feeds-connector
• Install the development version (version 1.7.d at the time of writing):
  
  Code Select Expand
  pkg install os-q-feeds-connector-devel
• Check that your API key is filled in under Security > Q-Feeds Connect > Settings and press Apply. No paid subscription? Activate the promo license below first.
• Force a full update, so the MITRE data is loaded right away. Everyone needs to do this once, both new installs and upgrades:
  
  Code Select Expand
  /usr/local/opnsense/scripts/qfeeds/qfeedsctl.py fetch_index fetch db_update firewall_load unbound_load dnscryptproxy_loadThis can take a while. You should see lines like "downloaded ... entries", "database sync executed" and "load feed __qfeeds_...".

To go back to the regular version later, run:

Code Select Expand

pkg remove os-q-feeds-connector-devel
pkg install os-q-feeds-connector
No paid subscription? Test with 14 days of premium access

Testers who are not on a paid Q-Feeds subscription can use the promo code CALL-FOR-MITRE-TEST. It gives you 14 days of access to the premium feeds and the full MITRE mapping, so you can try the filters with the complete data set.

• Log in to the Q-Feeds Threat Intelligence Portal, or create a free account: https://tip.qfeeds.com
• Redeem the code at https://tip.qfeeds.com/views/activate_license.php
• Attach the test license to an API key. Without this step the license will not be active for the plugin.
• Enter that API key in Security > Q-Feeds Connect > Settings, press Apply and run the update command from step 5 above.

Useful commands

Code Select Expand

# show your licensed feeds and when the next update is due
configctl qfeeds info

# force a full update now: download, MITRE index, aliases and DNS blocklists
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py fetch_index fetch db_update firewall_load unbound_load dnscryptproxy_load

# show the MITRE tactics, techniques, software and groups known to the local database
/usr/local/opnsense/scripts/qfeeds/qfeedsctl.py get_ip_meta

# count the entries of an alias
pfctl -t __qfeeds_<name> -T show | wc -l

Reporting back

Please reply in this thread with:

• OPNsense version and plugin version (System > Firmware > Status)
• Hardware or VM specs
• What you tested, and what worked or did not work
• For problems: the output of the forced update command above, any errors from System > Log Files > Backend or General, and a screenshot where it helps

Reproducible bugs can also go straight to GitHub: https://github.com/opnsense/plugins/issues (please start the title with [os-q-feeds-connector-devel]).

A big thank you to Ad and the Deciso team for the work on this release, and thanks in advance to everyone who helps test it.

The Q-Feeds team

Hi Patrick! Thank you for your feedback as well. It only wasn't visible for customers who have purchased the license via our 'old' website. We've switched to the new website in July. As an early adopter you weren't able to see it. We've now backfilled the database so it should be visible for you as well.

Correct! We've committed some changes to improve the communication around renewals. Next time it should be more clear ;) Thank you for your feedback and your trust in Q-Feeds.

That's great feedback and we will start working on improving it right away, thank you very much! In order to answer your question; in most cases auto-renew is enabled, you can manage that part on our website: https://qfeeds.com/account/ . If auto-renew is not enabled and the license expires then you need to purchase a new license and link it to the API key.

I understand the confusion and as mentioned promise to improve it.

I won't comment on the other solutions, as I may be a little biased, but with Q-Feeds you're unlikely to notice any performance impact. You may even save resources by placing it upstream, since solutions that perform more intensive behavioral analysis won't need to process threats that Q-Feeds has already filtered out.

Hi Wrigleys, That's a valid point as well, yet a hacker could also just change the domain as a whole, which happens more often ;-) It's up to us to make sure every domain get's listed as fast as possible (preferred within 20 minutes) without obviously blocking legitimate services. Maybe it would be a nice change request for unbound to read every domain as a wildcard entry ?

Stay safe!

David

Very sorry for the late reply... the reason we are not supporting wildcard formats is because it creates too much false positives. while some domains could be 'collapsed' in the feed, the benefit of wildcarding those will be very small. Or are we missing something?

Sorry we picked up this problem via our support system where this problem was logged as well. Glad the fix worked!

We've implemented some changes regarding this, please let us know if you're still experiencing alert fatigue ;-)

[The Custom Feed Hurdle:]

Dear community,

It's been a while since we've posted an update, but we've got a pretty big one in the pipeline. Right now, our setup is limited to three distinct feeds which don't leave much room for granular choice:

• Malware IP list
• Malware DNS list
• Phishing URL list (on request / requires proxy capabilities)

(Don't worry, these aren't going anywhere!)

The Custom Feed Hurdle: Initially, we wanted to build a custom feed generator allowing users to filter by threat scores, MITRE mappings, etc. However to be completely honest, it takes a massive toll on our infrastructure if 4,000+ users/companies are constantly compiling and pulling entirely unique feeds. We aren't quite there yet. It is still on our to do list though.

Our Plan B (Pre-Defined Feeds): Instead, we are rolling out a wider variety of curated, pre-defined feeds. Given that we pull from a 15M+ IOC database (You can browser it in our TIP / IOC browser), what distinguished feeds would actually add value to your OPNSense firewalls?

Some ideas we're tossing around:

• Risk tier splits (e.g., separating by High, Medium, and Low risk thresholds)
• Specific MITRE ATT&CK techniques or vectors
• Threat actor focused feeds

Drop your ideas or use cases below.

Sorry for the late reaction and thank you for this feedback. Granular controls like you describe might become difficult and feels risky. We don't like whitelisting very much ;-) Will have a look on what we can do.

Obviously sorry for the inconvenience. But the only way to get this solved in the future within an hour (and often sooner) is indeed to let us know via our false positive reporting in the TIP.

Thumbs up to you

Thank you!!

Dear community,

Last weekend we launched our new website, including the subscription management portal that was already available before.

As part of this update, we've worked on integrating the TIP more closely with the website and introduced Single Sign-On (SSO) to make the experience smoother. We're planning to add more integrations and improvements in the future.

We'd love to hear your feedback. If you notice anything that could be improved, something that doesn't work as expected, or simply have suggestions, please let us know.

Thanks in advance for taking the time to test it and share your thoughts!